ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) activity by monitoring for eight specific indicators of compromise that may signal an unknown adversary presence within the network. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly isolate and investigate early-stage RAT infections before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 8 IOC Types: url, domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["64.89.160.16"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.89.160.16"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["customers.googlesecuritysystem.com", "tax-preparer-security-viewer.federal-portal.es"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://babacan.lol/mods/api/log-download", "https://babacan.lol/ws", "https://babacan.lol/?p=", "https://babacan.lol/get/config", "https://babacan.lol/babayla/zor/yarisirlar/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Unknown RAT IOCs detection rule:

• Scenario: Automated Endpoint Protection Scans

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) perform scheduled deep scans or definition updates that generate network connections to external update servers. These connections often match the “Unknown RAT” IOCs due to similar port usage and payload signatures.
  • Filter/Exclusion: Exclude traffic originating from specific EDR service accounts (e.g., svc-crowdstrike, msdefender) or filter out destinations known to be official update servers (e.g., *.crowdstrike.com, *.microsoft.com).

• Scenario: Third-Party Backup and Synchronization Tools

  • Context: Scheduled backup jobs utilizing tools like Veeam, Commvault, or OneDrive for Business initiate large data transfers to cloud repositories. The background synchronization processes often utilize network patterns indistinguishable from Remote Access Trojans (RATs), triggering the 8 IOC hunt package.
  • Filter/Exclusion: Create a whitelist for known backup service executables (e.g., Veeam.Backup.Service.exe, OneDrive.exe) and exclude traffic directed to verified corporate cloud storage domains (e.g., *.veeam.com, *.office365.com).

• Scenario: Remote Desktop Gateway Sessions

  • Context: Administrators accessing internal servers via Citrix Workspace or Microsoft Remote Desktop Services (RDS) generate persistent, high-volume network sessions. The rule may misinterpret the handshake and data stream characteristics of these legitimate remote access tools as unknown RAT activity.
  • Filter/Exclusion: Exclude connections where the source process is Citrix.WorkspaceApp.exe or `mst