ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies potential Remote Access Trojan (RAT) compromises by monitoring network and endpoint telemetry against eight specific Indicators of Compromise (IOCs) linked to unknown malware variants. Proactively hunting for these signals in Azure Sentinel is critical to uncover stealthy adversaries that may have evaded standard signature-based defenses, allowing the SOC team to rapidly isolate affected assets before lateral movement occurs.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`195[.]177[.]94[.]245:443`	botnet_cc	2026-08-07	75%
ip:port	`217[.]217[.]97[.]36:443`	botnet_cc	2026-08-07	75%
ip:port	`104[.]239[.]66[.]130:443`	botnet_cc	2026-08-07	75%
ip:port	`195[.]177[.]94[.]26:443`	botnet_cc	2026-08-07	75%
ip:port	`195[.]177[.]94[.]80:443`	botnet_cc	2026-08-07	75%
ip:port	`94[.]154[.]32[.]185:443`	botnet_cc	2026-08-07	75%
ip:port	`192[.]159[.]99[.]153:443`	botnet_cc	2026-08-07	75%
ip:port	`45[.]88[.]186[.]14:443`	botnet_cc	2026-08-07	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["94.154.32.185", "45.88.186.14", "195.177.94.245", "195.177.94.80", "195.177.94.26", "217.217.97.36", "192.159.99.153", "104.239.66.130"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.32.185", "45.88.186.14", "195.177.94.245", "195.177.94.80", "195.177.94.26", "217.217.97.36", "192.159.99.153", "104.239.66.130"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown RAT IOCs detection rule in an enterprise environment:

Endpoint Security Software Updates & Telemetry
- Scenario: Major Endpoint Detection and Response (EDR) platforms like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently generate network traffic to update their signature databases. These updates often involve connections to new or rotating IP addresses that may not yet be in the threat intelligence feed, triggering a “Unknown RAT” alert when the EDR agent communicates with its cloud backend.
- Filter/Exclusion: Exclude traffic originating from specific EDR service accounts (e.g., svc-crowdstrike, MDE-Service) or whitelist known EDR update server IP ranges (e.g., *.crowdstrike.com, *.microsoftonline.com).
Scheduled Backup and Data Replication Jobs
- Scenario: Automated backup solutions such as Veeam, Rubrik, or Commvault run nightly jobs that scan file systems and replicate data to cloud storage. These tools often initiate outbound connections to external S3 buckets, Azure Blob Storage, or on-premises replication targets using ports and protocols that mimic RAT behavior (e.g., periodic polling, large data uploads), causing the rule to flag them as potential remote access tools.
- Filter/Exclusion: Create an exclusion based on the process name of the backup agent (e.g., Veeam.Backup.Service.exe, RubrikAgent) and restrict the alert logic to only trigger if the destination IP is not within the organization’s known cloud storage CIDR blocks.
Third-Party Software Deployment via Configuration Management
- Scenario: IT operations teams use tools like Ansible, Puppet, or **Microsoft SCCM (Configuration