ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) activity by correlating unknown Indicators of Compromise (IOCs) that may signal early-stage adversary reconnaissance or command-and-control establishment. Proactive hunting for these signals in Azure Sentinel is critical to rapidly isolate compromised endpoints before the RAT establishes persistent access and facilitates lateral movement across the network.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["186.169.76.60"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["186.169.76.60"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["elpolacopop.dynuddns.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are the documented false positive scenarios and corresponding filters for the ThreatFox: Unknown RAT IOCs rule:

• Scenario: Automated Endpoint Protection Updates

  • Context: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender) performs a scheduled nightly update. During this process, the agent downloads new definition signatures and behavioral models from an external repository that may not yet be fully whitelisted in the ThreatFox intelligence feed.
  • Filter/Exclusion: Create a rule exclusion based on the specific Process Name (e.g., FalconSensor.exe, S1Agent.exe) or the Parent Process ID of the update service. Additionally, exclude traffic originating from known internal update servers (e.g., WSUS server IPs) or specific external CDN endpoints used by the vendor.

• Scenario: IT Admin Deploying New Remote Management Tools

  • Context: An administrator uses a remote management tool like BeyondTrust, TeamViewer, or AnyDesk to troubleshoot a critical workstation. The session involves downloading a temporary diagnostic agent or establishing a new tunnel, which generates network IOCs (hashes and URLs) that the ThreatFox engine flags as “Unknown” because they are not yet in the global threat library.
  • Filter/Exclusion: Implement an exclusion based on User Context for accounts belonging to the IT_Ops or Helpdesk groups. Alternatively, filter out alerts where the initiating process is a known remote management executable (e.g., beyondtrust-agent.exe, TeamViewer_Service.exe) running under an administrative user context.

• Scenario: Scheduled PowerShell Script Execution for Asset Discovery

  • Context: A nightly scheduled task runs a custom PowerShell script (AssetDiscovery.ps1) that queries external APIs