ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt identifies adversary activity involving known DCRat remote access trojan indicators of compromise to detect potential command-and-control communications or lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this high-severity threat allows the SOC team to isolate infected endpoints before the malware establishes persistence and exfiltrates sensitive data.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["128.90.112.249", "141.94.121.162"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["128.90.112.249", "141.94.121.162"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, tailored to an enterprise environment using common security and management tools:

• Endpoint Management Software Updates

  • Scenario: The organization utilizes Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons to push firmware updates for network hardware. During a scheduled maintenance window, the update agent downloads a compressed archive containing DCRat-related libraries or configuration files from a trusted internal repository, triggering the hash-based IOC match on the endpoint.
  • Filter/Exclusion: Exclude file paths located within the specific software distribution folders (e.g., C:\Program Files\Microsoft Configuration Manager\Updates\) and restrict the rule to only flag processes originating from outside of known administrative service accounts (e.g., exclude NT SERVICE\SCCMService).

• Legacy Remote Access Tool Deployment

  • Scenario: The IT operations team deploys a legacy remote support tool, such as TeamViewer or AnyDesk, to non-critical workstations. The installer includes a bundled component (e.g., a specific DLL or helper executable) that shares the same SHA-256 hash or network signature as the DCRat IOC, particularly when connecting to the vendor’s update servers.
  • Filter/Exclusion: Create an exclusion for the specific process names of the remote access tools (e.g., TeamViewer_Service.exe, AnyDesk.exe) and whitelist their associated installation directories (C:\Program Files\TeamViewer\ or C:\ProgramData\AnyDesk\).

• Scheduled Antivirus Definition Synchronization

  • Scenario: A scheduled task runs nightly via Windows Task Scheduler to synchronize threat intelligence feeds. The CrowdStrike Falcon Sensor or SentinelOne Agent downloads a large definition package that