ThreatFox: Overlord RAT IOCs

Hunt Hypothesis

This hunt targets adversary activity involving the Overlord Remote Access Trojan (RAT) by identifying specific indicators of compromise that signal unauthorized remote access and potential data exfiltration. Proactively hunting for these IOCs within Azure Sentinel is critical to rapidly detect early-stage infections, enabling the SOC team to isolate affected endpoints before the RAT establishes persistence or expands its lateral movement across the network.

IOC Summary

Malware Family: Overlord RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Overlord RAT
let malicious_ips = dynamic(["46.151.182.85", "31.77.57.104"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.151.182.85", "31.77.57.104"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Overlord RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Overlord RAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Legitimate Enterprise Antivirus Scanning of Quarantined Archives

  • Scenario: The endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender) performs a scheduled deep scan of the C:\Quarantine directory. This directory often contains archived logs, old installation packages, and previously flagged but benign files that match specific Overlord RAT hash signatures or file paths used in previous test deployments.
  • Suggested Filter/Exclusion: Create an exclusion rule to ignore alerts originating from processes running under the Antimalware Service Executable (MsMpEng.exe) or the vendor’s specific scanner service when the target path contains keywords like \Quarantine\, \Temp\Scan\, or \Archive\.

• IT Administration: Deployment of Legacy Patch Management Agents

  • Scenario: The IT Operations team deploys a legacy patch management agent (e.g., Ivanti, ManageEngine Endpoint Central, or SCCM) to update the Overlord RAT client itself on non-critical workstations. During this deployment, the installer extracts temporary files and configuration manifests that contain known IOCs associated with the Overlord framework, triggering the rule before the agent is fully registered as trusted.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is a known deployment tool (e.g., ccmsetup.exe, IvantiAgent.exe) and the execution path is within the standard software distribution folder (e.g., C:\Program Files\Microsoft Intune Agent or C:\ProgramData\ManageEngine).

• Scheduled Backup Jobs Processing Development Environments

  • Scenario: