ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies potential Remote Access Trojan (RAT) activity by monitoring network traffic and endpoint logs for specific Indicators of Compromise (IOCs) linked to unknown threat actors. Proactive hunting in Azure Sentinel is critical because RATs often establish persistent footholds that can lead to data exfiltration or lateral movement if not identified early through these targeted IOCs.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["198.46.243.188"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["198.46.243.188"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: Unknown RAT IOCs detection rule:

• Scenario: Scheduled Antivirus or EDR Definition Updates

  • Context: Enterprise security suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection frequently download new definition signatures and heuristic modules from their cloud repositories. These updates often manifest as new network connections to unknown endpoints that match the “Unknown RAT” profile in ThreatFox, especially during off-hours maintenance windows (e.g., 02:00 UTC).
  • Filter/Exclusion: Create a rule exclusion based on the source process name and destination domain. Exclude alerts where ProcessName matches known security agents (e.g., C:\Program Files\CrowdStrike\fsqa.exe, msrtss.exe) AND DestinationDomain ends in official vendor TLDs (e.g., .crowdstrike.com, .microsoftonline.net).

• Scenario: Automated Software Deployment via Configuration Management Tools

  • Context: IT administrators use tools like Microsoft SCCM, Ansible, or Puppet to push software updates and patches across the fleet. These agents often establish outbound connections to internal artifact repositories (e.g., a local Nexus Repository or Artifactory) that may not yet be whitelisted in the ThreatFox IOC database, triggering “Unknown RAT” alerts due to the nature of the traffic pattern.
  • Filter/Exclusion: Implement an exclusion based on the source IP range and process path. Exclude events where SourceIP falls within the internal management subnet (e.g., 10.50.20.0/24) AND ProcessPath contains keywords like \SCCM\, \Ansible\, or \Puppet\.