ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This rule detects the presence of known indicators of compromise associated with unidentified Remote Access Trojans, signaling potential unauthorized remote control or data exfiltration attempts. Proactively hunting for these IOCs in Azure Sentinel is critical to identify stealthy, low-fidelity threats that may evade signature-based detections and establish persistent footholds within the environment.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 8 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["antimalwarediagnostics.st", "silentnet.st"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://thisisafalsepositive.st/shard/submitData", "https://thisisafalsepositive.st/shard/submitFile", "https://thisisafalsepositive.st/shard/submitWallet", "https://thisisafalsepositive.st/shard/submitWalletFiles", "https://thisisafalsepositive.st/shard/submitDiscordInjection", "https://thisisafalsepositive.st/shard/submitLogs"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

• Legacy Application Update via PowerShell: A legacy line-of-business application (e.g., an older version of Adobe Creative Suite or a specific ERP client) uses powershell.exe to download and execute an update script from a vendor-hosted IP that has not yet been added to the threat intelligence feed.
  • Filter/Exclusion: Exclude powershell.exe parent processes where the command line contains specific vendor update tokens (e.g., *-update*, *-install*) or restrict the rule to non-standard ports (e.g., exclude 80/443 if the IOC is specifically for non-HTTP/S RATs).
• IT Admin Manual Troubleshooting: An IT administrator uses cmd.exe or powershell.exe to manually download a diagnostic tool or patch from a known internal file server or public GitHub repository for troubleshooting purposes, where the IP address matches a recently observed but benign ThreatFox entry.
  • Filter/Exclusion: Exclude processes initiated by service accounts or known admin group SIDs, or filter out connections to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) if the IOC is an IP-based indicator.
• Scheduled Backup or Sync Job: A scheduled task (e.g., Task Scheduler job) runs a script that connects to a cloud storage endpoint (like AWS S3 or Azure Blob) using a specific IP or domain that overlaps with a known RAT C2 server in the ThreatFox feed, often due to shared CDN infrastructure.
  • Filter/Exclusion: Exclude parent processes like svchost.exe (if the job is a service) or specific scheduled task names (e.g., *Backup*, `*Sync