ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving four specific Indicators of Compromise (IOCs) linked to the DCRat remote access trojan, which is frequently used by threat actors for command and control operations within compromised networks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage infections before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Malware Family: DCRat Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`46[.]246[.]14[.]5:8848`	botnet_cc	2026-07-30	75%
ip:port	`118[.]107[.]46[.]177:12159`	botnet_cc	2026-07-30	75%
ip:port	`118[.]107[.]46[.]177:8848`	botnet_cc	2026-07-30	75%
ip:port	`118[.]107[.]46[.]204:12159`	botnet_cc	2026-07-30	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["118.107.46.177", "118.107.46.204", "46.246.14.5"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["118.107.46.177", "118.107.46.204", "46.246.14.5"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the ThreatFox: DCRat IOCs detection rule in an enterprise environment:

Scenario: Legitimate Remote Administration via PowerShell
- Context: System administrators frequently use PowerShell.exe to query remote machines or deploy scripts using specific hash values that match known DCRat indicators (e.g., a common management script hosted on an internal server). The detection logic may flag the process command line or network connection as suspicious due to overlapping IOCs.
- Filter/Exclusion: Create a whitelist entry for PowerShell.exe when executed by the built-in SYSTEM account or specific administrative service accounts (e.g., DOMAIN\svc-admin). Additionally, exclude traffic originating from known internal IP ranges used for patch management (e.g., SCCM servers) where the destination port matches standard admin ports (5985/5986).
Scenario: Scheduled Antivirus or EDR Scanning Jobs
- Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne often perform scheduled scans that generate network connections to update servers. These agents may utilize hashing algorithms or communication patterns that mimic the DCRat IOCs, particularly if the agent’s signature database is updated via a channel shared with the threat intelligence feed.
- Filter/Exclusion: Exclude process paths matching the specific EDR agent executables (e.g., C:\Program Files\CrowdStrike\csagent.exe or C:\Windows\System32\MsMpEng.exe). Add an exclusion for scheduled tasks named “Antivirus Scan” or “Threat Intelligence Update” that run during off-peak hours.
Scenario: Internal Software Deployment via Configuration Management Tools
- Context: IT operations