ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are deploying a previously unidentified Remote Access Trojan (RAT) within the environment, evidenced by the presence of specific threat indicators from ThreatFox. Proactive hunting for these IOCs in Azure Sentinel is critical to rapidly detect and contain this novel malware before it establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["44.223.110.247"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["44.223.110.247"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["shadowcape.online"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Unknown RAT IOCs detection rule, tailored for an enterprise environment:

• Endpoint Management Agent Updates

  • Scenario: The deployment of a new version or hotfix for enterprise endpoint management tools (e.g., Microsoft Intune, CrowdStrike Falcon, or Trend Micro Apex One) often involves the download and execution of installer packages containing IOCs that mimic Remote Access Trojan behaviors. These legitimate agents frequently establish persistent connections and inject code into system processes, triggering the “Unknown RAT” signature.
  • Suggested Filter: Create an exclusion for known vendor hashes and specific executable paths (e.g., C:\Program Files\Microsoft Intune\* or C:\ProgramData\CrowdStrike\*) that match the IOCs during scheduled maintenance windows.

• Remote Desktop Administration Sessions

  • Scenario: IT administrators performing routine troubleshooting using remote access tools like Microsoft Remote Desktop (RDP), TeamViewer, or AnyDesk generate network traffic and process creation events identical to RAT activity. Specifically, when an admin connects from a jump host to manage a server cluster, the tool’s background services may spawn child processes that hit the “Unknown” IOC criteria due to frequent version updates not yet whitelisted in the ThreatFox feed.
  • Suggested Filter: Exclude traffic and process execution originating from known administrative IP subnets (e.g., 10.20.x.x) or whitelist specific user accounts with the “HelpDesk_Admin” role when accessing standard RDP ports (3389, 5938).

• Automated Backup and Sync Operations

  • Scenario: Scheduled backup jobs utilizing tools like Veeam Backup & Replication, Rubrik, or Microsoft Azure Backup Agent often utilize remote connectivity protocols to transfer