ThreatFox: Brute Ratel C4 IOCs

Hunt Hypothesis

The detection identifies potential Brute Ratel C4 infrastructure by matching known IOCs associated with the adversary’s command and control activities. SOC teams should proactively hunt for this behavior to detect early-stage compromise and disrupt the adversary’s communication and command capabilities within their Azure Sentinel environment.

IOC Summary

Malware Family: Brute Ratel C4 Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Brute Ratel C4
let malicious_ips = dynamic(["163.172.174.237"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["163.172.174.237"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Brute Ratel C4

False Positive Guidance

• Scenario: Legitimate scheduled system backup using rsync
  Filter/Exclusion: Exclude processes initiated by the root user or those matching the rsync command with known backup paths (e.g., /backup/ or /var/backups/).

• Scenario: Admin task to update DNS records using nsupdate
  Filter/Exclusion: Exclude processes initiated by the named service or users with sudo privileges performing DNS-related tasks with known domain names.

• Scenario: Regular log rotation using logrotate
  Filter/Exclusion: Exclude processes with the logrotate command and paths in /var/log/ or /etc/logrotate.d/.

• Scenario: Use of curl or wget for legitimate API calls to internal services
  Filter/Exclusion: Exclude traffic to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or known internal APIs (e.g., /api/v1/health).

• Scenario: Automated CI/CD pipeline using git to pull code from a private repository
  Filter/Exclusion: Exclude processes initiated by CI/CD agents (e.g., jenkins, gitlab-runner) or with SSH keys matching known CI/CD key fingerprints.