ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) activity by monitoring network traffic and endpoint logs for seven specific Indicators of Compromise (IOCs) linked to an unknown threat actor. A proactive hunt is essential in Azure Sentinel because early identification of these RAT signatures allows the SOC team to isolate compromised assets before adversaries establish persistent access or exfiltrate sensitive data.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 7 IOC Types: ip:port, domain, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["64.89.160.29"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.89.160.29"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["bendesin.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://bendesin.com/get/config", "https://bendesin.com/?p=", "https://bendesin.com/babayla/zor/yarisirlar/", "https://bendesin.com/ws", "https://bendesin.com/mods/api/log-download"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs detection rule, along with targeted mitigation strategies:

• Scenario: Endpoint Protection Engine Updates

  • Context: The enterprise uses CrowdStrike Falcon or Microsoft Defender for Endpoint. During scheduled update cycles (e.g., Tuesday at 02:00 AM), the security agent downloads new definition packages and telemetry modules. These updates often generate network connections to cloud endpoints that match the “Unknown RAT” signature due to similar port usage and encrypted traffic patterns, even though they are legitimate vendor communication.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name (FalconSensor.exe or MsMpEng.exe) combined with the Parent Process being the update service (e.g., FalconService). Additionally, exclude traffic destined for known vendor IP ranges (e.g., CrowdStrike’s US-East IPs) from the IOC matching logic.

• Scenario: Scheduled Remote Management Tasks

  • Context: The IT Operations team utilizes SCCM (System Center Configuration Manager) or Jamf Pro to push configuration profiles and inventory scripts to workstations. These tools establish persistent connections to management servers that mimic RAT behavior by polling for status updates and pushing binary payloads, which triggers the 7-IOC hunt package.
  • Filter/Exclusion: Implement a filter excluding alerts where the User Account is a known service account (e.g., svc_sccm_agent or jamf-prod) and the Destination Port matches standard management ports (8443 for SCCM, 9001 for Jamf). This ensures that scheduled inventory jobs do not trigger the RAT alert.

• Scenario: Third-Party Collaboration Tool Auto-Syncs

  • Context: Employees utilize **