ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies potential Remote Access Trojan (RAT) activity by monitoring for five specific indicators of compromise that may signal an unknown adversary establishing persistent access within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify and contain stealthy RAT infections before they can exfiltrate sensitive data or pivot deeper into the network.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 5 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["professional.baby"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://professional.baby/get/config", "https://professional.baby/babayla/zor/yarisirlar/", "https://professional.baby/mods/api/log-download", "https://professional.baby/?p="]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

• Scenario: The corporate Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, is performing its daily automated threat intelligence synchronization. During this process, the EDR agent pulls a generic “Unknown RAT” feed from a third-party provider that includes IOCs not yet mapped to known enterprise assets, triggering the hunt package.

  • Suggested Filter: Create an exclusion based on the specific Process Name of the EDR service (e.g., FalconService.exe or MsSenseService.exe) and restrict the rule trigger to only execute when the source IP belongs to the internal threat intelligence server subnet, excluding external pull jobs.

• Scenario: A scheduled maintenance job running on a central file server utilizes PowerShell scripts to scan and update the local registry with new security signatures for the organization’s custom Remote Access Tool (RAT) implementation. The script generates temporary IOCs that match the “Unknown” criteria before being fully cataloged in the SIEM.

  • Suggested Filter: Implement a filter excluding events where the Parent Process is powershell.exe and the command line contains specific keywords like -ExecutionPolicy Bypass -File UpdateSignatures.ps1, or add the specific server hostname to an allow-list for this detection rule.

• Scenario: The IT Operations team deploys a new version of a legitimate internal collaboration tool (e.g., Zoom or Microsoft Teams) via System Center Configuration Manager (SCCM). The deployment agent installs background services that register new network connections and file hashes, which the ThreatFox engine initially flags as unknown RAT IOCs due to the lack of historical baseline data.

  • Suggested Filter: Exclude alerts where the Installation Source is identified as ccmexec.exe (SCCM) or where the event timestamp falls within a defined “Change Window