ThreatFox: EtherRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of EtherRAT remote access trojans by monitoring for specific indicators of compromise within network and endpoint telemetry. Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage espionage activities before they escalate into full-scale data exfiltration or lateral movement incidents.

IOC Summary

Malware Family: EtherRAT Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - EtherRAT
let malicious_domains = dynamic(["update.norwayeast.cloudapp.azure.com", "tklovers.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — EtherRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: EtherRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: The organization’s EDR (e.g., CrowdStrike Falcon or Microsoft Defender) periodically scans the C:\ProgramData\ThreatFox\Quarantine folder. This directory contains archived threat intelligence feeds and historical IOC snapshots, including benign EtherRAT signatures used for training models. When the scanner extracts these archives to verify integrity, it triggers a file creation event matching the EtherRAT IOCs, even though no actual malware is present on the endpoint.
  • Filter/Exclusion: Exclude events where the parent process is the EDR service (e.g., CrowdStrike.exe or MsMpEng.exe) and the file path contains \Quarantine\ or \ThreatIntelligence\.

• Scheduled Security Awareness Training Downloads

  • Scenario: The IT department runs a scheduled task using PowerShell (Start-ScheduledTask) every Monday at 08:00 to distribute security awareness materials. These materials include sample malware analysis reports and interactive training modules that utilize the EtherRAT framework as a case study. The download process creates temporary files in C:\Temp\SecTraining matching the specific hash or file name IOCs defined for EtherRAT.
  • Filter/Exclusion: Create an exclusion for the powershell.exe process when the command line arguments contain keywords like “SecurityAwareness” or “EtherRAT_Training,” specifically targeting the C:\Temp\SecTraining directory.

• Software Deployment via SCCM/Intune

  • Scenario: During a monthly patch cycle, System Center Configuration Manager (SCCM) or Microsoft Intune dep