DarkComet RAT

Hunt Hypothesis

This hunt targets adversaries deploying the DarkComet Remote Access Trojan to establish persistent command-and-control channels and execute remote sessions on compromised endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because its low-severity classification may cause initial alerts to be overlooked, allowing attackers to maintain undetected access while exfiltrating sensitive data over time.

YARA Rule

rule DarkComet_1 : RAT
{
    meta:
        description = "DarkComet RAT"
	author = "botherder https://github.com/botherder"

    strings:
        $bot1 = /(#)BOT#OpenUrl/ wide ascii
        $bot2 = /(#)BOT#Ping/ wide ascii
        $bot3 = /(#)BOT#RunPrompt/ wide ascii
        $bot4 = /(#)BOT#SvrUninstall/ wide ascii
        $bot5 = /(#)BOT#URLDownload/ wide ascii
        $bot6 = /(#)BOT#URLUpdate/ wide ascii
        $bot7 = /(#)BOT#VisitUrl/ wide ascii
        $bot8 = /(#)BOT#CloseServer/ wide ascii

        $ddos1 = /(D)DOSHTTPFLOOD/ wide ascii
        $ddos2 = /(D)DOSSYNFLOOD/ wide ascii
        $ddos3 = /(D)DOSUDPFLOOD/ wide ascii

        $keylogger1 = /(A)ctiveOnlineKeylogger/ wide ascii
        $keylogger2 = /(U)nActiveOnlineKeylogger/ wide ascii
        $keylogger3 = /(A)ctiveOfflineKeylogger/ wide ascii
        $keylogger4 = /(U)nActiveOfflineKeylogger/ wide ascii

        $shell1 = /(A)CTIVEREMOTESHELL/ wide ascii
        $shell2 = /(S)UBMREMOTESHELL/ wide ascii
        $shell3 = /(K)ILLREMOTESHELL/ wide ascii

    condition:
        4 of ($bot*) or all of ($ddos*) or all of ($keylogger*) or all of ($shell*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 18 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the DarkComet RAT detection rule in an enterprise environment, including suggested filters and exclusions:

• Legitimate Remote Administration via DarkComet Enterprise Suite

  • Scenario: IT Helpdesk or System Administrators utilize the official DarkComet software (often deployed as a remote management tool for non-Windows endpoints like macOS or Linux) to perform routine patching, file transfers, and session monitoring on managed workstations. The detection logic flags the standard DarkCometAgent.exe communication with the central server as malicious because the process name matches known RAT signatures.
  • Filter/Exclusion: Exclude traffic where the source process is located in a trusted directory (e.g., C:\Program Files\DarkComet\) and the destination IP belongs to the organization’s internal Remote Management subnet or verified public cloud endpoints (e.g., AWS/Azure IPs used by your DarkComet instance).

• Scheduled Backup Jobs Utilizing DarkComet CLI

  • Scenario: A scheduled Task Scheduler job runs nightly at 02:00 AM to execute a custom backup script that invokes the DarkCometCLI.exe tool. This script pushes configuration snapshots and logs to a central repository, generating network connections identical to those of an active RAT agent, triggering alerts during off-hours maintenance windows.
  • Filter/Exclusion: Create a time-based exclusion for traffic originating from specific “Backup Server” hostnames or IP ranges between 01:30 AM and 04:30 AM, specifically filtering out connections initiated by the DarkCometCLI.exe process with a known file hash.

• Third-Party Vendor Onboarding and Asset Inventory Scans

  • Scenario: During quarterly vendor onboarding or asset inventory cycles, external security consultants deploy temporary DarkComet agents to audit network topology