ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving five specific Indicators of Compromise (IOCs) linked to the TonRAT remote access trojan, which is known for establishing persistent backdoors and exfiltrating sensitive data. The SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage infections before attackers can leverage the trojan’s capabilities to move laterally or escalate privileges within the environment.

IOC Summary

Malware Family: TonRAT Total IOCs: 5 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["driveponsphoto.info", "hakdfgklsdk833ksd.com", "photo-drivedisk.com", "jokesprite.info", "haobbao.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: TonRAT IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Antivirus or EDR Definition Updates

  • Context: Enterprise security suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection frequently download definition updates from vendor repositories. If the update package contains a hash or network artifact matching one of the TonRAT IOCs (e.g., a specific DLL signature), the rule triggers during the nightly maintenance window.
  • Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. Exclude alerts where ProcessName matches known security agents (e.g., FalconSensor.exe, MsMpEng.exe) AND StartTime falls within the configured maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Legitimate Remote Administration via PowerShell

  • Context: System administrators often use PowerShell scripts to push configurations or query inventory across the domain. If an admin script invokes a command that downloads a resource from a trusted internal repository (e.g., http://internal-repo.corp.com/tonrat-config.xml), and this URL matches a TonRAT network IOC, it generates a false positive.
  • Filter/Exclusion: Implement a filter on the User Account and Command Line. Exclude events where the user belongs to the Domain Admins or IT_Ops security group AND the command line contains keywords like -Download, -Update, or specific internal domain suffixes (e.g., .corp.com).

• Scenario: Third-Party Software Deployment via SCCM/Intune

  • Context: During mass software deployments using **Microsoft Endpoint Configuration Manager (