ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies active DCRat remote access trojan infections by monitoring for five specific indicators of compromise known to facilitate command-and-control communication and data exfiltration. Proactive hunting for these IOCs in Azure Sentinel is critical because DCRat’s ability to establish persistent backdoors allows adversaries to maintain long-term access, necessitating early intervention before sensitive assets are compromised.

IOC Summary

Malware Family: DCRat Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`93[.]115[.]27[.]97:8848`	botnet_cc	2026-07-31	75%
ip:port	`118[.]107[.]46[.]207:8848`	botnet_cc	2026-07-31	75%
ip:port	`118[.]107[.]46[.]204:8848`	botnet_cc	2026-07-31	75%
ip:port	`118[.]107[.]46[.]207:12159`	botnet_cc	2026-07-31	75%
ip:port	`45[.]59[.]120[.]43:7001`	botnet_cc	2026-07-31	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["118.107.46.204", "45.59.120.43", "118.107.46.207", "93.115.27.97"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["118.107.46.204", "45.59.120.43", "118.107.46.207", "93.115.27.97"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Backup Solutions Scanning Network Shares
- Context: Enterprise backup agents (e.g., Veeam, Rubrik, or Commvault) frequently scan network shares and external drives where DCRat IOCs (such as specific file hashes or registry keys used by the malware) may coincidentally match legitimate backup metadata or temporary staging files.
- Filter/Exclusion: Exclude processes originating from known backup service accounts (e.g., VeeamBackupSvc, RubrikAgent) and filter out alerts where the source path contains standard backup directories like \Backup\Staging or \Temp.
Scenario: Endpoint Protection Engine Real-Time Scanning
- Context: The organization’s primary EDR/Antivirus solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs real-time heuristic scanning. When the engine updates its signature database or scans a specific application bundle containing DCRat-like components, it may trigger the rule against the AV service process itself rather than user activity.
- Filter/Exclusion: Create an exclusion list for the ImageFileName of major EDR services (e.g., FalconSensor.exe, MsMpEng.exe, SentinelOneAgent.exe) and exclude alerts where the parent process is the AV service itself.
Scenario: Scheduled Software Deployment via SCCM/Intune
- Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune pushes software updates that include installer packages containing DCRat-associated registry keys or file artifacts as part of the deployment manifest. These legitimate administrative tasks mimic the behavior of the malware’s installation phase.