ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of DCRat remote access trojans by monitoring for specific file hashes and network indicators known to facilitate command-and-control communications. Proactive hunting in Azure Sentinel is critical because early detection of these high-severity IOCs allows the SOC team to isolate compromised endpoints before attackers can establish persistent footholds or exfiltrate sensitive data.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`196[.]251[.]121[.]120:35630`	botnet_cc	2026-07-12	100%
ip:port	`172[.]86[.]77[.]116:5656`	botnet_cc	2026-07-12	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["196.251.121.120", "172.86.77.116"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["196.251.121.120", "172.86.77.116"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, tailored for an enterprise environment:

Legacy RDP Management Tool Updates
- Scenario: The IT Operations team uses a legacy remote management suite (e.g., ManageEngine Desktop Central or TeamViewer Enterprise) that periodically downloads and installs updates. These tools often utilize generic download URLs or shared CDN endpoints that may hash-match against DCRat’s command-and-control (C2) infrastructure, particularly if the tool uses similar TLS certificate chains or IP ranges for its update servers.
- Filter/Exclusion: Create an exclusion rule to whitelist traffic originating from specific service accounts (e.g., svc_desktop_mgmt) and restrict the detection scope to exclude known internal management subnets where these tools are deployed.
Scheduled Antivirus Definition Synchronization
- Scenario: During off-hours, enterprise endpoint protection agents (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) execute scheduled jobs to pull the latest virus definition and threat intelligence feeds. If DCRat IOCs include common IP ranges used by major security vendors’ update servers, these routine synchronization tasks will trigger alerts on every endpoint simultaneously.
- Filter/Exclusion: Implement a time-based filter to suppress alerts between 02:00 and 04:00 UTC for processes named MsMpEng.exe (Defender) or CrowdStrikeService.exe, provided the destination IP matches the vendor’s known update infrastructure.
Software Deployment via Configuration Management
- Scenario: The DevOps team utilizes Microsoft System Center Configuration Manager (SCCM) or Ansible to push software patches and configuration scripts to workstations. These deployment agents often initiate outbound connections to download packages from internal artifact repositories (like **Artif