ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the TonRAT Remote Access Trojan to establish persistent footholds through phishing campaigns that facilitate data exfiltration and remote command execution. Proactively hunting for these specific IOCs within Azure Sentinel is critical to identify early-stage compromises before attackers can fully exploit system access or silently extract sensitive information.

IOC Summary

Malware Family: TonRAT Total IOCs: 10 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["cloud-pic.info", "drivefolder-photo7392.info", "extranet-guests-reported.com", "extranetpartner-reports.com", "imgcloudpr.info", "photoimg-vault.info", "safeimagephoto.info", "safephoto-docs.info", "safevisa-hb.info", "secure-vh.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

False Positive Scenarios for “ThreatFox: TonRAT IOCs” Rule

• Scenario: Legitimate Phishing Simulation Campaigns

  • Context: Security teams frequently conduct internal phishing simulations using platforms like KnowBe4 or Proofpoint. These tools often distribute emails containing malicious-looking attachments (e.g., .docx with macros) that mimic the initial delivery vector of TonRAT. When users open these simulated files, the detection engine may flag the macro execution or the specific hash as a potential TonRAT indicator.
  • Suggested Filter/Exclusion: Create an exclusion based on the source email sender domain (e.g., @knowbe4.com, @proofpoint.com) and exclude traffic originating from the internal simulation server IP range during known campaign windows.

• Scenario: Scheduled Admin Maintenance via PowerShell

  • Context: System administrators routinely run scheduled maintenance jobs using Windows Task Scheduler to execute complex scripts involving remote command execution (a core TonRAT capability). If these scripts utilize specific network ports or hash signatures similar to the TonRAT IOCs, they may trigger alerts. For instance, a nightly backup script running powershell.exe with arguments that match the rule’s logic for arbitrary command execution.
  • Suggested Filter/Exclusion: Exclude events where the parent process is TaskSchedulerService.exe (or svchost.exe if configured) and the executed file path resides within a trusted administrative directory, such as C:\ProgramData\CorpAdmin\Maintenance.

• Scenario: Legitimate Remote Support Tools

  • Context: Enterprise Help Desks utilize remote access tools like BeyondTrust, ConnectWise ScreenConnect, or TeamViewer to assist users. These tools inherently perform the same functions as TonRAT (remote command execution, file exfiltration,