ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) activity by monitoring network traffic and endpoint logs for specific Indicators of Compromise (IOCs) linked to unknown threat actors. Proactively hunting for these signals in Azure Sentinel is critical because RATs often establish persistent, stealthy footholds that can lead to data exfiltration or lateral movement if not detected early through continuous IOC correlation.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["http://64.89.160.97:2404/login", "http://2.26.227.212:2404/login"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

False Positive Scenarios for “ThreatFox: Unknown RAT IOCs”

• Scenario: Automated Patch Deployment via WSUS/SCCM

  • Context: During nightly maintenance windows, the enterprise utilizes Microsoft System Center Configuration Manager (SCCM) or WSUS to push updates. The deployment agent often establishes new network connections and executes scripts that match the behavioral profile of a Remote Access Trojan (RAT), specifically triggering IOCs related to outbound traffic to unknown endpoints or script execution in temporary directories.
  • Suggested Filter/Exclusion: Create an exclusion rule for processes originating from C:\Windows\CCM\ or C:\Program Files\Microsoft Update Agent. Additionally, exclude alerts occurring between 01:00 and 05:00 UTC on the specific host groups tagged as “Patch-Target” to reduce noise during scheduled maintenance.

• Scenario: Enterprise Backup Solutions (Veeam/Acronis)

  • Context: Veeam Backup & Replication or Acronis Cyber Protect agents frequently initiate high-volume data transfers and spawn child processes for compression and encryption. These activities often involve network connections to backup repositories that may not be in the ThreatFox known-good list, mimicking the “unknown” communication patterns of a RAT exfiltrating data.
  • Suggested Filter/Exclusion: Implement a process-based exclusion for VeeamAgent.exe, vbrservice.exe, and AcronisCyberProtectService. Configure the detection logic to ignore IOCs where the parent process is identified as one of these known backup services, regardless of the destination IP.

• Scenario: Cloud Sync and Collaboration Tools (OneDrive/Box)

  • Context: Users running Microsoft OneDrive for Business or Box Enterprise in the background perform continuous file synchronization. These tools