ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt targets adversary activity involving the six specific Indicators of Compromise (IOCs) linked to the DCRat remote access trojan, which is frequently used for command and control communications. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of DCRat presence allows the SOC team to isolate compromised endpoints before attackers establish persistent access or exfiltrate sensitive data.

IOC Summary

Malware Family: DCRat Total IOCs: 6 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["178.16.52.10", "128.90.112.26", "128.90.105.93", "27.124.43.182"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.16.52.10", "128.90.112.26", "128.90.105.93", "27.124.43.182"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - DCRat
let malicious_domains = dynamic(["comienzo.ydns.eu", "guaricha.ydns.eu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Agent Updates via Scheduled Task

  • Scenario: The organization uses a scheduled task (e.g., Task Scheduler on Windows) to run nightly updates for the endpoint protection agent (such as CrowdStrike Falcon, SentinelOne, or Carbon Black). These agents often download and execute installation packages that contain hashes matching DCRat’s legitimate IOCs, specifically when updating their own telemetry modules.
  • Filter/Exclusion: Create an exclusion for processes launched by the specific service account (e.g., NT AUTHORITY\SYSTEM or a dedicated svc_ep_update) running from the known update directory path (e.g., C:\Program Files\EndpointAgent\Updates\*). Additionally, exclude events where the parent process is the OS scheduler (svchost.exe with specific service name) during business hours outside of peak activity windows.

• Software Deployment via Microsoft Endpoint Configuration Manager (MECM/SCCM)

  • Scenario: The IT Operations team deploys a new software package or patch using Microsoft SCCM (now Intune/Endpoint Manager). The deployment agent (ccmexec.exe) downloads and executes installers that may include DCRat IOCs as part of the payload, particularly if the deployed software relies on similar network communication libraries or cryptographic signatures found in the DCRat threat profile.
  • Filter/Exclusion: Filter out events where the parent process is ccmexec.exe and the command line arguments contain specific deployment identifiers (e.g., /DeploymentID, /PackageID). You can also exclude file paths located within the SCCM cache directory (C:\Windows\CCMCache) or the Software Center installation folder