ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) intrusions by correlating specific Indicators of Compromise (IOCs) that may evade standard signature-based defenses. Proactively hunting for these unknown IOCs in Azure Sentinel is critical to rapidly isolate compromised endpoints and prevent lateral movement before the adversary establishes a persistent foothold within the environment.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["193.26.115.211"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.26.115.211"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["roland.uscourt.online"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Unknown RAT IOCs rule in an enterprise environment, including suggested filters and exclusions:

• Software Deployment via SCCM/Intune: System Center Configuration Manager (SCCM) or Microsoft Intune often pushes new Remote Desktop Protocol (RDP) agents or monitoring utilities to endpoints. These legitimate installations may generate network connections to IP addresses or domains that match the “Unknown RAT” IOCs in ThreatFox, particularly if the vendor is a niche security tool not yet whitelisted globally.

  • Suggested Filter: Exclude traffic originating from specific deployment service accounts (e.g., DOMAIN\SCCM-Deploy-Svc) and destination ports associated with known software update channels (e.g., TCP 443, 853) during standard maintenance windows (02:00–06:00 UTC).

• Legacy Application Maintenance Scripts: IT operations teams frequently utilize PowerShell or Python scripts to perform health checks on legacy ERP systems. These scripts often invoke external APIs for logging or status reporting, which may trigger the rule if the API endpoints are hosted on infrastructure recently flagged by ThreatFox as potential RAT command-and-control (C2) nodes.

  • Suggested Exclusion: Create a whitelist for specific scheduled tasks identified in the Event Log (e.g., Task Scheduler events with Task Name containing “LegacyHealthCheck”) and exclude the associated process hashes (powershell.exe or python3.exe) running under the context of the Local System account.

• Third-Party Cloud Backup Agents: Enterprise backup solutions like Veeam, Commvault, or Acronis run background agents that periodically communicate with cloud storage gateways. If these gateways utilize dynamic IP ranges that overlap with ThreatFox’s “Unknown RAT” indicators (often common in shared cloud environments), the rule may flag these routine data synchronization events as