ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This hypothesis targets the deployment of Remote Access Trojans (RATs) by leveraging newly identified indicators of compromise from the ThreatFox feed to detect malicious payloads that may have evaded traditional signature-based detection. Proactively hunting for these unknown IOCs in Azure Sentinel is critical to identify persistent backdoors and establish early visibility into adversary footholds before they progress to lateral movement or data exfiltration.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 13 IOC Types: sha256_hash, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["esunager.net", "dibardo.net", "sotikan.net", "medonaz.net", "remuloz.net", "giperon.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown RAT
let malicious_hashes = dynamic(["e16d11d02dd4ff355c4832fbdaa950d88852b47133e33a253e043ebc1f5a5dc3", "e94a99395a2f5f33c84020f767151a2e464b1b32d7e323c949dbcee8577e4af2", "086f5e17a9d3a30460f3f8ff95613ef7c5b479831ff5163015b2b7ea42cd3679", "345d1a775867b9e79ee6b0825e1e2416d715550f2162ac32c076f0371c8553e1", "db11d553f89f4ef02f725c96f7af7a3659bf17831a8e73966f1af4e92be6c594", "1dc438b8979a4d7125cc5cc64b80cc76b49a4b3197fb3b7b7fd6bbfe2ed25c82", "bad0600a850436154f8d7b6f7a191dc45bd136897780cd032b336cb4b358d241"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

• Legitimate Remote Support Sessions: IT support personnel using commercial remote access tools (e.g., TeamViewer, AnyDesk, or Parsec) that may register temporary processes or network connections matching known RAT IOCs.
  • Filter/Exclusion: Exclude processes where the parent process is a known remote support application (e.g., TeamViewer.exe, AnyDesk.exe) or filter by specific user groups designated for remote support.
• Software Development and Testing: Developers running virtual machines, containerized environments, or testing new applications that intentionally simulate malicious behavior or use open-source RAT frameworks (e.g., Metasploit, Cobalt Strike) in isolated test labs.
  • Filter/Exclusion: Exclude hosts tagged with Dev-Test or Lab in their asset inventory, or filter by specific IP ranges assigned to the development VLAN.
• Scheduled Backup and Maintenance Jobs: Automated backup solutions (e.g., Veeam, Commvault) or maintenance scripts that establish high-bandwidth connections or execute specific binary names that overlap with known RAT IOCs.
  • Filter/Exclusion: Exclude events where the initiating process is a known backup agent (e.g., VeeamSvc.exe, cvp.exe) or filter by scheduled task names containing keywords like Backup, Maintenance, or Sync.
• Third-Party Plugin Updates: Applications with auto-update features (e.g., Adobe Creative Cloud, Slack, or Zoom) that download and execute update binaries from trusted CDNs, which may temporarily match IOC hashes or network endpoints.
  • Filter/Exclusion: Exclude network connections to known trusted CDN domains (e.g., adobe.com, zoom.us) or filter by processes associated with major software suites (e.g., AdobeUpdateService.exe, ZoomUpdate.exe).
• Administrative Tooling and Scripting: