ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt targets the presence of TonRAT, a remote access trojan, by correlating its known indicators of compromise to identify compromised endpoints or network artifacts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect stealthy persistence mechanisms and command-and-control channels before the adversary can escalate privileges or exfiltrate sensitive data.

IOC Summary

Malware Family: TonRAT Total IOCs: 20 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	photo0826jpg.com	payload_delivery	2026-09-21	100%
domain	photo0926jpg.com	payload_delivery	2026-09-21	100%
domain	photolink-checkzip.com	payload_delivery	2026-09-21	100%
domain	property-onlines.com	payload_delivery	2026-09-21	100%
domain	stayreportdesk.life	payload_delivery	2026-09-21	100%
domain	yd2s-extranet.cfd	payload_delivery	2026-09-21	100%
domain	be6-extranet.cfd	payload_delivery	2026-09-21	100%
domain	bookphotohotel.info	payload_delivery	2026-09-21	100%
domain	checlappart.help	payload_delivery	2026-09-21	100%
domain	download0596.com	payload_delivery	2026-09-21	100%
domain	download0644.com	payload_delivery	2026-09-21	100%
domain	dropfilesbox.com	payload_delivery	2026-09-21	100%
domain	filecheck-drive-photo.icu	payload_delivery	2026-09-21	100%
domain	help-desk0926.com	payload_delivery	2026-09-21	100%
domain	helpdesk-0826.com	payload_delivery	2026-09-21	100%
domain	helpdesk-0926.com	payload_delivery	2026-09-21	100%
domain	helpdesk09-26.com	payload_delivery	2026-09-21	100%
domain	helpdesk1026.com	payload_delivery	2026-09-21	100%
domain	helpdesk1509.com	payload_delivery	2026-09-21	100%
domain	mujiapbnktest.lol	payload_delivery	2026-09-21	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["photo0826jpg.com", "photo0926jpg.com", "photolink-checkzip.com", "property-onlines.com", "stayreportdesk.life", "yd2s-extranet.cfd", "be6-extranet.cfd", "bookphotohotel.info", "checlappart.help", "download0596.com", "download0644.com", "dropfilesbox.com", "filecheck-drive-photo.icu", "help-desk0926.com", "helpdesk-0826.com", "helpdesk-0926.com", "helpdesk09-26.com", "helpdesk1026.com", "helpdesk1509.com", "mujiapbnktest.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — TonRAT

False Positive Guidance

• Scenario: A DevOps engineer deploys a new version of a microservice using a container image that was built from a base layer containing a known vulnerable library or outdated dependency, which happens to match one of the 20 TonRAT IOCs (e.g., a specific SHA256 hash of a shared library or a specific file path like C:\Program Files\MyApp\libton.dll).
  • Filter/Exclusion: Exclude alerts where the process path resides under standard application directories (e.g., C:\Program Files\, C:\Program Files (x86)\) and the parent process is a recognized deployment tool (e.g., kubectl, docker.exe, helm.exe, or ansible-playbook).
• Scenario: An IT administrator runs a scheduled PowerShell script to clean up temporary files or rotate logs, and the script inadvertently creates or touches a file with a name or hash that matches a TonRAT IOC (e.g., a generic name like update.exe or helper.dll located in a temp folder, which is a common TonRAT disguise).
  • Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or pwsh.exe and the command line contains known administrative verbs (e.g., Remove-Item, Clear-RecycleBin, Get-ChildItem) or the script path is under a designated admin automation directory (e.g., C:\Scripts\, C:\Admin\).
• Scenario: A security team performs a red team exercise or a vulnerability scan using a tool that intentionally drops benign files or mimics malware behavior to test detection coverage, and these test files match the TonRAT IOCs.
  • Filter/Exclusion: Exclude alerts where the parent process is a known testing tool (e.g., cobaltstrike.exe,