ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This hunt targets the presence of known indicators of compromise associated with an unidentified Remote Access Trojan, which adversaries deploy to establish persistent, covert control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate infected assets before the attacker leverages the RAT for lateral movement, data exfiltration, or further payload delivery.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["erdogan.lol", "selamselam.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

• Remote Desktop Administration via Third-Party Tools: Legitimate IT operations teams often use remote access tools like TeamViewer, AnyDesk, or LogMeIn for administrative tasks. These tools may use specific memory patterns or network endpoints that overlap with the “Unknown RAT” IOCs, particularly if the vendor uses generic naming conventions or shared infrastructure.

  • Filter/Exclusion: Exclude processes where the parent process is known administrative tools (e.g., TeamViewer.exe, AnyDesk.exe) or exclude network connections to known vendor IP ranges (e.g., *.teamviewer.com, *.anydesk.com).

• Scheduled Backup or Sync Jobs: Enterprise backup solutions like Veeam, Commvault, or Rubrik often run scheduled jobs that involve high-volume data transfer and specific memory allocations. If the backup agent communicates with a cloud endpoint or local repository using a port or protocol that matches the RAT’s C2 beaconing pattern, it can trigger the detection.

  • Filter/Exclusion: Exclude processes matching backup agent names (e.g., VeeamBackup.exe, commvaultagent.exe) or exclude network sessions where the destination is a known backup server IP or domain (e.g., *.veeam.com, *.rubrik.com).

• Software Update Mechanisms: Applications like Adobe Creative Cloud, Microsoft Office, or Java perform periodic updates by downloading payloads from their respective CDNs. These updates may involve writing to specific directories or using temporary network connections that resemble the IOCs of the Unknown RAT, especially if the update server uses a non-standard port or a newly registered domain.

  • Filter/Exclusion: Exclude processes associated with update services (e.g., AdobeUpdateService.exe, OfficeC2RClient.exe) or exclude network connections to known update domains (e.g., `*.adobe.com