ThreatFox: RatonRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the RatonRAT remote access tool by identifying specific indicators of compromise (IOCs) known to facilitate credential theft and lateral movement within an Azure environment. Proactively hunting for these signals in Azure Sentinel is critical because RatonRAT’s high severity profile suggests a significant risk of persistent unauthorized access that could lead to data exfiltration if not identified early.

IOC Summary

Malware Family: RatonRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - RatonRAT
let malicious_ips = dynamic(["23.153.36.72", "84.98.112.243"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["23.153.36.72", "84.98.112.243"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — RatonRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: RatonRAT IOCs detection rule:

• Scenario: Legitimate Software Updates via Microsoft Update Agents

  • Context: The Microsoft Windows Update service (or third-party tools like WSUS or Chocolatey) frequently downloads update manifests and binaries that may share hash signatures or network endpoints with RatonRAT IOCs, particularly if the vendor uses shared cloud infrastructure.
  • Filter/Exclusion: Exclude processes where ProcessName matches usoc.dll, wuauserv.exe, or choco.exe AND ParentProcessName is svchost.exe. Additionally, whitelist specific SHA256 hashes known to belong to the organization’s standard update agents.

• Scenario: Scheduled Administrative Backups using Enterprise Tools

  • Context: Scheduled backup jobs running via tools like Veeam Backup & Replication, Commvault, or Acronis Cyber Protect often utilize network ports and file transfer mechanisms that mimic the behavior of RatonRAT. These jobs may generate network traffic to known IOCs if they rely on shared storage gateways or cloud repositories.
  • Filter/Exclusion: Create an exclusion for processes running under specific Service Accounts (e.g., DOMAIN\svc_backup_admin) where the process name contains keywords like “Veeam”, “Commvault”, or “Acronis”. Filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Endpoint Detection and Response (EDR) Telemetry Collection

  • Context: EDR agents such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint periodically send telemetry data to their cloud management consoles. If the R