ThreatFox: Brute Ratel C4 IOCs

Hunt Hypothesis

This hunt detects adversary reconnaissance and initial access activities by identifying network traffic matching specific Indicators of Compromise (IOCs) linked to the Brute Ratel C4 threat actor. Proactively hunting for these signatures in Azure Sentinel is critical to rapidly identify early-stage intrusions, enabling the SOC team to isolate compromised assets before the attacker establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: Brute Ratel C4 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Brute Ratel C4
let malicious_ips = dynamic(["16.76.80.179", "3.115.55.199"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["16.76.80.179", "3.115.55.199"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Brute Ratel C4

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Brute Ratel C4 IOCs detection rule:

• Scenario: Automated Vulnerability Scanning by Qualys or Tenable

  • Context: Enterprise vulnerability management platforms (e.g., Qualys Cloud Agent, Tenable Nessus) frequently probe external IP ranges and internal subnets to assess security posture. These scanners often utilize the same IOCs (IPs/URLs) associated with Brute Ratel C4 for their own update feeds or remote scanning nodes, triggering alerts when they connect to known threat infrastructure.
  • Suggested Filter: Exclude traffic originating from the specific IP ranges of your vulnerability management platform’s scanning engines (e.g., SourceIP IN [Qualys_Scan_Range]) and filter out connections where the process name matches the scanner agent (e.g., ProcessName = "qualyspc.exe" or "nessus_scan_service").

• Scenario: Scheduled Office 365 Hybrid Connectivity Checks

  • Context: In hybrid environments, Microsoft Exchange or Azure AD Connect services perform scheduled heartbeat checks and synchronization tasks. If the Brute Ratel C4 IOCs overlap with Microsoft’s global update servers or specific CDN endpoints used by O365, legitimate sync jobs will generate hits during peak business hours (e.g., 09:00–17:00).
  • Suggested Filter: Create an exclusion for processes related to Office 365 synchronization (e.g., ProcessName IN ["Microsoft.Exchange.Transport.exe", "AzureADConnect.exe"]) and restrict the rule trigger to non-business hours or exclude specific destination ports commonly used by O365 (Ports 443, 8080) when the source is a known domain controller.

• **Scenario: Endpoint Protection Definition Updates via CrowdStrike