ThreatFox: RatonRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy the RatonRAT remote access trojan to establish persistence and exfiltrate sensitive data via its known indicators of compromise. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this high-severity threat prevents lateral movement and limits the window for potential data breaches before automated alerts trigger.

IOC Summary

Malware Family: RatonRAT Total IOCs: 6 IOC Types: ip:port, md5_hash, sha256_hash, sha1_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - RatonRAT
let malicious_ips = dynamic(["87.58.204.146", "158.160.75.185", "89.125.120.77"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["87.58.204.146", "158.160.75.185", "89.125.120.77"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - RatonRAT
let malicious_hashes = dynamic(["a1cdb3fea0437aab03b9fbd4dcce6416", "fddc9cca767ef639b17d70374bb9ca9d5c6516f58b9b63cae86f593ced0f3b6b", "15c68e17d1f3905e527bbf217bf2614f82dc552f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — RatonRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: RatonRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Signature Updates via Windows Update

  • Scenario: The organization uses Microsoft Defender Antivirus (or a similar EDR like CrowdStrike) which periodically downloads and installs signature definition updates. These updates often include new hash values for known benign files that may overlap with the RatonRAT IOCs, particularly if the threat intelligence feed shares common vendor libraries or if the update package itself contains a file matching one of the 6 specific hashes.
  • Filter/Exclusion: Create an exclusion rule based on the process name MsMpEng.exe (Microsoft Defender) or C:\Program Files\Windows Defender\MpCmdRun.exe. Additionally, exclude alerts where the parent process is UsocoreWorker.exe (Windows Update Orchestrator Service), as these are standard administrative update tasks.

• Scheduled Software Deployment via SCCM/Intune

  • Scenario: The IT operations team utilizes Microsoft Endpoint Configuration Manager (MECM) or Microsoft Intune to push a scheduled deployment of a legacy business application (e.g., an internal inventory tool) that relies on specific DLLs matching the RatonRAT IOCs. When the deployment agent (ccmexec.exe) extracts and installs these components during off-hours, it triggers the detection logic for file creation or execution.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe (System Center Configuration Manager) or IntuneManagementExtension.exe. Furthermore, filter by user context to exclude accounts running under the “SYSTEM” or a dedicated service account like svc-software-deploy, which are typically trusted for mass installations.

• Third-Party Backup Agent Scanning