ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the DCRat remote access trojan by monitoring for three specific indicators of compromise known to facilitate command and control communications. Proactively hunting for these signals in Azure Sentinel is critical because early identification of DCRat infections allows the SOC team to rapidly isolate compromised endpoints before attackers can establish persistent footholds or exfiltrate sensitive data.

IOC Summary

Malware Family: DCRat Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["98.156.49.133", "104.251.181.111", "128.90.102.72"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["98.156.49.133", "104.251.181.111", "128.90.102.72"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Jobs Utilizing Shared Credentials

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often run scheduled tasks that connect to multiple endpoints using a shared service account. If the DCRat IOCs include specific hash values or network connections associated with these backup agents, the rule may trigger when the backup agent communicates with the central management server during its nightly window.
  • Filter/Exclusion: Create an exclusion based on the Process Name and User Account.
    • Logic: Exclude alerts where Process Name matches vssvc.exe, commvault_service.exe, or veeamagent.exe AND Account Name is a known service account (e.g., svc_backup_prod).

• Scenario: Endpoint Detection and Response (EDR) Scanning Artifacts

  • Context: Real-time protection engines like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black frequently generate temporary files or network connections that match the behavioral patterns of DCRat. Specifically, if the IOCs include specific file hashes used by EDR telemetry modules, a routine full system scan can trigger a false positive.
  • Filter/Exclusion: Filter based on Parent Process Name and File Path.
    • Logic: Exclude events where the parent process is FalconSensorService.exe, MsMpEng.exe, or CarbonBlack.exe AND the file path resides within the EDR installation directory (e.g., C:\Program Files\CrowdStrike\...).

• Scenario: Scheduled Software Deployment via Group Policy

  • Context: IT administrators often deploy software