ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies potential Remote Access Trojan (RAT) activity by monitoring for specific indicators of compromise that may represent unknown or emerging threats within the network. A proactive hunt is essential in Azure Sentinel to rapidly isolate and investigate these RAT behaviors before they establish persistence or exfiltrate sensitive data, given their high severity and ability to evade standard signature-based defenses.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["lxxlxxnew.noip.at", "asyfrainvite.cyou"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

False Positive Scenarios for “ThreatFox: Unknown RAT IOCs”

• Scenario: Scheduled Endpoint Security Updates

  • Context: The enterprise’s patch management system (e.g., Microsoft SCCM or Ivanti) triggers a nightly update job that downloads and executes new definition files from the vendor. These updates often contain newly discovered Remote Access Trojan (RAT) signatures that have not yet been ingested into the ThreatFox threat intelligence feed, causing them to appear as “Unknown” IOCs during the scan window.
  • Suggested Filter/Exclusion: Create a rule exclusion based on the Process Name (ccmsetup.exe or IvantiAgent.exe) and restrict the detection to run only outside of the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Admin-Driven Forensic Tool Deployment

  • Context: A System Administrator uses a portable forensic tool like Sysinternals Process Explorer or Velociraptor to investigate a user-reported issue. During the investigation, the tool scans network shares and local directories for potential threats, generating IOCs that match known RAT patterns but are flagged as unknown because the specific hash of the admin’s custom deployment is not in the global ThreatFox database.
  • Suggested Filter/Exclusion: Exclude alerts where the Initiating User belongs to the Domain Admins or IT_Operations security group, and filter out processes running from the C:\Tools\ directory path.

• Scenario: Third-Party Backup Agent Scans

  • Context: The organization utilizes a cloud backup solution such as Veeam Backup & Replication or Rubrik. The agent performs deep integrity checks on critical assets, which involves scanning file hashes and network connections that