ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hypothesis detects TonRAT activity by identifying indicators of compromise associated with a remote access trojan that establishes persistence through phishing vectors to execute commands and exfiltrate sensitive data. A proactive hunt is essential in Azure Sentinel to rapidly identify initial infection points via malicious email links or attachments, thereby preventing the establishment of long-term unauthorized access before attackers can fully entrench their command-and-control infrastructure.

IOC Summary

Malware Family: TonRAT Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["fileview-directa.info", "viewphotodrive.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: TonRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Phishing Simulation Campaigns

  • Context: Security teams frequently use tools like KnowBe4, Proofpoint Security Awareness Training, or GoPhish to run internal phishing simulations. These campaigns often distribute emails with links that redirect users to a secure landing page hosted on the vendor’s cloud infrastructure, which may share IP ranges or URL patterns similar to TonRAT distribution points.
  • Suggested Filter: Exclude traffic originating from known simulation sender domains (e.g., @knowbe4.com, @proofpoint.com) and specific internal campaign subdomains in the detection logic.

• Scenario: Scheduled Remote Management Tasks

  • Context: IT Operations teams utilize remote management tools such as Microsoft Endpoint Manager (Intune), SCCM, or TeamViewer to push updates, run scripts, or manage configurations on endpoints during off-hours. These tools often establish persistent connections and execute command sequences that mimic TonRAT’s “command execution” and “persistent access” behaviors.
  • Suggested Filter: Create an exclusion for processes running under specific service accounts (e.g., DOMAIN\svc-intune, DOMAIN\svc-sccm) or whitelist the executable hashes of known RMM agents (IntuneAgent.exe, TeamViewer_Service.exe).

• Scenario: Automated Backup and Data Exfiltration Jobs

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Acronis Cyber Protect perform scheduled data transfers to cloud repositories. These jobs involve reading large volumes of data and transmitting them over the network, which can trigger alerts related to “data theft” or high-volume outbound connections typical