ThreatFox: DarkComet IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the six specific indicators of compromise (IOCs) linked to the DarkComet remote access trojan, which is frequently used by threat actors for persistent command and control operations. The SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage infections that may evade standard signature-based detection, thereby enabling rapid containment before lateral movement occurs.

IOC Summary

Malware Family: DarkComet Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`176[.]129[.]203[.]146:1604`	botnet_cc	2026-07-30	50%
ip:port	`86[.]109[.]75[.]132:1604`	botnet_cc	2026-07-30	50%
ip:port	`86[.]109[.]75[.]132:7777`	botnet_cc	2026-07-30	50%
ip:port	`189[.]150[.]133[.]139:1604`	botnet_cc	2026-07-30	50%
ip:port	`151[.]247[.]193[.]128:7777`	botnet_cc	2026-07-30	50%
ip:port	`105[.]100[.]163[.]183:1604`	botnet_cc	2026-07-30	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DarkComet
let malicious_ips = dynamic(["151.247.193.128", "189.150.133.139", "86.109.75.132", "176.129.203.146", "105.100.163.183"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["151.247.193.128", "189.150.133.139", "86.109.75.132", "176.129.203.146", "105.100.163.183"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DarkComet

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: DarkComet IOCs detection rule in an enterprise environment:

Scenario: Scheduled Backup Jobs Utilizing DarkComet-Associated Ports
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize specific network ports and connection patterns that overlap with DarkComet’s C2 communication. If the detection logic flags outbound connections to known IOCs (e.g., specific IP ranges or DNS queries) used by these backup agents during nightly windows, it triggers false alerts.
- Suggested Filter: Create an exclusion rule based on Process Name and Time Window. Exclude events where ProcessName matches VeeamAgent.exe or CommServe.exe occurring between 02:00 and 06:00 local time, provided the destination IP belongs to the internal backup server subnet.
Scenario: Software Deployment via Microsoft Endpoint Configuration Manager (MECM/SCCM)
- Context: During mass software deployments or patch cycles, Microsoft SCCM clients initiate high-volume network traffic to distribution points and content libraries. If DarkComet IOCs include common CDNs or public update servers that SCCM also queries for content synchronization, the detection logic may misinterpret these legitimate download streams as malicious beaconing activity.
- Suggested Filter: Implement a filter based on User Context and Source IP. Exclude alerts where the InitiatingUser is a member of the “SCCM-Admins” or “Deployment-Accounts” group, or where the source host belongs to the dedicated SCCM management point subnet.
Scenario: Legacy Remote Management Tools (e.g., TeamViewer or AnyDesk)
- Context: Many organizations rely on legacy remote access tools like **Team