ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the TonRAT remote access tool by monitoring for matches against a curated set of twelve specific indicators of compromise within Azure Sentinel logs. Proactively hunting for these IOCs is critical to identify early-stage lateral movement and command-and-control communications, allowing the SOC team to isolate compromised assets before the threat escalates into a broader breach.

IOC Summary

Malware Family: TonRAT Total IOCs: 12 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["photo-lookup0321.info", "res-photo-look.info", "extranet-partner-reports.com", "extranets-partner-report.com", "hakdksjwec392dk.com", "letsheeio.info", "photo-drivegog.info", "photo-googlwork83.info", "photo-id8431.info", "bajdskalslfk281sk.com", "document-1522.cfd", "cepliss.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: TonRAT IOCs detection rule in an enterprise environment:

• Scenario: Security Tool Internal Communication

  • Context: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) periodically queries its cloud management console to update threat intelligence feeds. If the TonRAT rule includes specific IP addresses or domain hashes that overlap with the vendor’s infrastructure, legitimate telemetry traffic will trigger alerts.
  • Filter/Exclusion: Create a process-based exclusion where the detection is suppressed if the source executable path matches known security agents (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or C:\Program Files\Microsoft Defender Antivirus\MsMpEng.exe).

• Scenario: Scheduled Backup and Patching Jobs

  • Context: Enterprise backup solutions like Veeam or Commvault often run nightly jobs that download large configuration files or software updates from external repositories. If these repositories utilize the same domain names or IP ranges as the TonRAT IOCs, the scheduled task execution will generate false positives during maintenance windows (e.g., 02:00 – 04:00).
  • Filter/Exclusion: Implement a time-based exclusion for the rule during defined maintenance windows. Alternatively, exclude specific Windows Scheduled Task names known to trigger this traffic, such as VeeamBackupService or Microsoft.SystemCenter.ConfigurationManager.

• Scenario: Legitimate Third-Party Software Updates

  • Context: Widely deployed enterprise applications (e.g., Adobe Acrobat Pro, Zoom, or Microsoft Office 365) automatically check for updates by contacting their respective update servers. If the TonRAT IOCs include generic CDNs or update domains shared by these vendors, routine auto-update