ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) activity by monitoring network and endpoint telemetry against six specific Indicators of Compromise (IOCs) linked to an unknown threat actor. The SOC team should proactively hunt for these signals in Azure Sentinel because early identification of this RAT can prevent lateral movement and data exfiltration before the adversary establishes a persistent foothold within the environment.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 6 IOC Types: ip:port, domain

Type	Value	Threat Type	First Seen	Confidence
ip:port	`94[.]198[.]96[.]165:62769`	botnet_cc	2026-08-11	75%
domain	`privatehos.casacam.net`	botnet_cc	2026-08-11	100%
domain	`zappelinej.noip.at`	botnet_cc	2026-08-11	75%
ip:port	`152[.]89[.]162[.]7:49798`	botnet_cc	2026-08-11	75%
ip:port	`217[.]60[.]241[.]91:443`	botnet_cc	2026-08-11	75%
ip:port	`94[.]154[.]32[.]228:443`	botnet_cc	2026-08-11	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["217.60.241.91", "152.89.162.7", "94.198.96.165", "94.154.32.228"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.241.91", "152.89.162.7", "94.198.96.165", "94.154.32.228"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["privatehos.casacam.net", "zappelinej.noip.at"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs detection rule, including targeted filters and exclusions:

Scenario: Endpoint Protection Agent Updates
- Context: The enterprise uses CrowdStrike Falcon or Microsoft Defender for Endpoint. During scheduled off-hours updates (e.g., 02:00 AM), the agent downloads new detection signatures or behavior models from an external update server. These downloads often utilize temporary executable names and network connections that match the generic “Unknown RAT” IOCs in the ThreatFox feed.
- Filter/Exclusion: Create a rule exclusion based on the Process Name (C-Update.exe, MsMpEng.exe) AND the Parent Process (the specific AV service). Additionally, exclude traffic originating from known internal update servers (e.g., WSUS or Cloudflare CDN IPs) during maintenance windows.
Scenario: Automated Backup and Archiving Jobs
- Context: A nightly scheduled task runs Veeam Backup & Replication or Commvault agents to archive logs and compress data. These tools frequently spawn temporary worker processes that open outbound connections to cloud storage buckets (e.g., AWS S3, Azure Blob) using SSL/TLS handshakes that mimic RAT command-and-control traffic patterns.
- Filter/Exclusion: Exclude the specific Scheduled Task Name (e.g., VeeamBackupJob_01) and the associated Service Account (svc-backup-agent). Filter out network destinations matching the organization’s known cloud storage IP ranges or DNS names (e.g., *.s3.amazonaws.com, *.blob.core.windows.net).
Scenario: Third-Party Remote Support Tools
- Context: The IT Helpdesk utilizes BeyondTrust, Splashtop, or **TeamViewer