ThreatFox: RatonRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the RatonRAT remote access tool by identifying specific indicators of compromise such as suspicious process executions and network connections linked to known malicious artifacts. Proactively hunting for these IOCs in Azure Sentinel is critical because RatonRAT enables attackers to establish persistent footholds, allowing them to exfiltrate sensitive data and execute commands across the environment before traditional alerts trigger.

IOC Summary

Malware Family: RatonRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - RatonRAT
let malicious_ips = dynamic(["91.92.40.138", "158.174.50.97"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.40.138", "158.174.50.97"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — RatonRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: RatonRAT IOCs detection rule in an enterprise environment:

• Scenario: Security Scanning by Endpoint Protection Agents

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download definition updates or threat intelligence feeds that may contain SHA-256 hashes matching RatonRAT IOCs. These scans often run during business hours and trigger the rule when the agent’s process connects to a known hash.
  • Filter/Exclusion: Exclude processes where ProcessName is one of the approved EDR agents (e.g., FalconSensor.exe, MsMpEng.exe) AND the parent process is the system service (svchost.exe or lsass.exe).

• Scenario: Legitimate Remote Administration via RDP/SSH

  • Context: System administrators performing routine maintenance on remote servers often utilize standard remote management tools. If an admin’s workstation has a cached certificate or network configuration that aligns with the RatonRAT IOCs (specifically IP addresses or domain names), their connection attempts will trigger alerts during scheduled maintenance windows.
  • Filter/Exclusion: Filter out events where UserAccount belongs to the “Domain Admins” or “IT_Ops” security group AND the source IP is within the corporate management subnet range (e.g., 10.20.x.x).

• Scenario: Scheduled Backup and Data Synchronization Jobs

  • Context: Automated backup solutions like Veeam, Commvault, or Azure Backup often utilize specific ports and network endpoints that may overlap with RatonRAT communication patterns. When these scheduled jobs execute (e.g., nightly at 2:00 AM), they generate network traffic matching the IOCs associated with the RAT’s command