ThreatFox: TonRAT IOCs

Hunt Hypothesis

This detection rule identifies indicators of compromise linked to the TonRAT remote access trojan, which adversaries leverage to establish persistent footholds and execute lateral movement within compromised networks. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early identification of TonRAT activity enables rapid containment before attackers can exfiltrate sensitive data or deploy additional payloads.

IOC Summary

Malware Family: TonRAT Total IOCs: 4 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["drive-photopage.info", "folder-photohotel.info", "guestsafeimage.icu", "load-drivefile.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters/exclusions for the ThreatFox: TonRAT IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Endpoint Protection Scanning

  • Context: Enterprise EDR agents (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently scan and hash specific files within their quarantine or definition update directories. If the TonRAT IOCs include file hashes that match known legitimate binaries used by these tools during a scheduled update cycle, the rule may trigger on every agent heartbeat.
  • Suggested Filter/Exclusion: Exclude processes where ProcessName matches MsMpEng.exe, CnsNotify.exe, or csagent.exe. Additionally, filter out events originating from specific system paths such as C:\Program Files\Microsoft Defender\Antimalware\ or C:\ProgramData\CrowdStrike\.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Automated backup solutions (e.g., Veeam, Commvault, or Windows Server Backup) often create temporary staging files or log entries that match the IOCs associated with TonRAT. These jobs usually run during off-hours via Task Scheduler, creating file artifacts that mimic the behavior of a remote access trojan establishing persistence.
  • Suggested Filter/Exclusion: Create an exclusion based on ParentProcessName matching backup service executables (e.g., vssvc.exe, veeamagent.exe) and restrict triggers to business hours (08:00–18:00) if the IOCs are known to be triggered by off-hour backups. Alternatively, exclude file paths containing keywords like \Backup\ or \Staging\.

• Scenario: Software Deployment via Configuration Management

  • Context: IT operations teams use tools like SCCM (Microsoft