ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt detects adversaries leveraging TonRAT remote access trojans delivered through phishing campaigns to establish persistent control and exfiltrate sensitive data via malicious domain connections. Proactive hunting for these indicators in Azure Sentinel is critical to identify early-stage lateral movement and prevent unauthorized remote access before significant data loss occurs.

IOC Summary

Malware Family: TonRAT Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["guestsafeimage.info", "photolog-hotel.top", "safeimageandphoto.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: TonRAT IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup or Synchronization Tools

  • Context: Enterprise backup solutions like Veeam, Rubrik, or cloud sync tools like OneDrive for Business often initiate outbound connections to external domains that may share IP ranges or subdomains with TonRAT’s infrastructure. These tools frequently perform scheduled data exfiltration (uploading large files) which mimics the “sensitive data exfiltration” behavior of TonRAT.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from specific Service Accounts (e.g., svc-backup-agent) or known backup appliances. Additionally, filter out connections where the User-Agent string contains keywords like “Veeam”, “OneDrive”, or “Dropbox” and the destination port is 443 with a consistent TLS fingerprint matching the vendor’s certificate.

• Scenario: Legitimate Phishing Simulation Campaigns

  • Context: Security teams often run internal phishing simulations using platforms like KnowBe4, Proofpoint, or Covisint. These campaigns involve sending emails with links that redirect users to external landing pages for training modules. If the simulation platform’s infrastructure overlaps with TonRAT’s known domains, user clicks on these legitimate training links will trigger the detection logic regarding “phishing email redirects.”
  • Filter/Exclusion: Implement a filter based on the source of the initial email. Exclude alerts where the originating email server is an internal Exchange Server or a recognized simulation platform (e.g., simulation.knowbe4.com). Furthermore, exclude traffic from IP ranges explicitly added to the “Trusted Simulation” group in your SIEM.

• **Scenario: Scheduled Software Update and Patch