This hunt detects potential Remote Access Trojan (RAT) activity by identifying indicators of compromise from the ThreatFox feed that may represent unknown adversary infrastructure. Proactively hunting for these IOCs in Azure Sentinel is critical to uncover stealthy initial access or command-and-control communications before they escalate into broader lateral movement or data exfiltration incidents.
Malware Family: Unknown RAT Total IOCs: 11 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 194[.]156[.]79[.]203:4449 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 195[.]177[.]94[.]112:443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 94[.]154[.]32[.]30:443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 195[.]177[.]94[.]91:443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 158[.]94[.]211[.]183:443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 104[.]249[.]10[.]76:443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 104[.]249[.]10[.]205:443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 104[.]239[.]66[.]228:443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 104[.]249[.]10[.]144:443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 45[.]83[.]28[.]88:443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 217[.]217[.]97[.]53:443 | botnet_cc | 2026-08-04 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["104.239.66.228", "194.156.79.203", "45.83.28.88", "195.177.94.91", "104.249.10.76", "158.94.211.183", "94.154.32.30", "217.217.97.53", "195.177.94.112", "104.249.10.205", "104.249.10.144"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.239.66.228", "194.156.79.203", "45.83.28.88", "195.177.94.91", "104.249.10.76", "158.94.211.183", "94.154.32.30", "217.217.97.53", "195.177.94.112", "104.249.10.205", "104.249.10.144"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Automated Endpoint Protection Scans by CrowdStrike Falcon
C:\Program Files\Microsoft Office directory. During this process, it generates temporary network connections to internal update servers that match the specific hash or IP IOCs defined in the Unknown RAT package.svc_falcon) and the specific source IP range of the internal update server (e.g., 10.20.50.x). Additionally, filter out alerts where the process name is falcon.sys or FalconService.exe.Scenario: Scheduled PowerShell Script for Patch Deployment
PatchDeploy.ps1) via Task Scheduler to distribute security updates. The script utilizes Invoke-WebRequest to download manifests from an internal repository, triggering network traffic patterns that mimic the RAT’s command-and-control (C2) behavior identified by the rule.TaskScheduler.exe and the executed file path matches the known script location (e.g., \\FileServer\Scripts\PatchDeploy.ps1). Implement a filter to ignore events occurring strictly between 02:00 and 04:00 UTC on weekdays.Scenario: Microsoft Teams Background Optimization
Teams.exe) initiates background telemetry and optimization tasks that open multiple outbound connections to Azure-based endpoints. These connections often utilize ports and destination IPs that overlap with the Unknown RAT’s IO