ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies potential Remote Access Trojan (RAT) activity by correlating unknown Indicators of Compromise (IOCs) that may signal an adversary establishing covert command and control channels within the network. Proactive hunting for these signals in Azure Sentinel is critical to rapidly identify early-stage infections before adversaries can exfiltrate sensitive data or pivot to other systems, thereby minimizing dwell time and preventing lateral movement.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["198.37.105.19", "172.245.12.92"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["198.37.105.19", "172.245.12.92"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown RAT IOCs detection rule:

• Scenario: Legitimate Endpoint Protection Updates

  • Context: Scheduled updates from major EDR vendors (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often download new definition packages or telemetry agents that contain hashes matching generic “Unknown RAT” signatures in the ThreatFox feed. These usually occur during off-hours maintenance windows.
  • Filter/Exclusion: Exclude process names containing C-Update.exe, MsMpEng.exe, or FalconService where the file path resides within the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\ or C:\ProgramData\Microsoft\Windows Defender\).

• Scenario: Admin Deployment of Remote Management Tools

  • Context: System administrators deploying remote access solutions like TeamViewer, AnyDesk, or Splashtop for temporary support sessions. The installation or first-run initialization of these tools generates network connections and file hashes that mimic RAT behavior due to their inherent remote control capabilities.
  • Filter/Exclusion: Create an exclusion rule for processes initiated by the System account or specific admin users (e.g., DOMAIN\IT-Admins) where the executable path matches known legitimate remote tools, such as C:\Program Files\TeamViewer\TeamViewer.exe.

• Scenario: Scheduled Backup and Monitoring Agents

  • Context: Enterprise backup solutions like Veeam Agent, Rubrik, or monitoring agents from Datadog run scheduled jobs that establish persistent connections to cloud repositories. These agents often utilize communication protocols and file signatures that overlap with the “Unknown RAT” IOC database, particularly when they perform initial handshakes or configuration syncs.
  • Filter/Exclusion: Filter out