This hunt targets the presence of DCRat malware indicators, a high-severity threat known for its ability to establish persistent remote access and execute arbitrary commands on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate infected endpoints before the adversary can leverage the malware for lateral movement or data exfiltration.
Malware Family: DCRat Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 178[.]16[.]54[.]35:8848 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 13[.]143[.]247[.]125:1458 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 121[.]127[.]233[.]190:7891 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 104[.]250[.]167[.]93:8080 | botnet_cc | 2026-09-23 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["121.127.233.190", "13.143.247.125", "178.16.54.35", "104.250.167.93"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["121.127.233.190", "13.143.247.125", "178.16.54.35", "104.250.167.93"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a containerized application that includes a lightweight diagnostic script containing the specific hash or string match for one of the DCRat IOCs. The script is executed in an ephemeral build agent or a dedicated staging environment where the IOC is part of the application’s dependency tree rather than a standalone executable.
C:\jenkins\workspace\, /home/runner/work/) or where the parent process is a known build tool (e.g., java.exe, node.exe, docker.exe).Scenario: An IT administrator runs a legacy backup verification utility that embeds a specific cryptographic hash or string constant matching one of the DCRat IOCs to validate file integrity. This utility is scheduled via Windows Task Scheduler to run nightly on file servers, and the IOC is detected in the memory of the backup service process.
vssadmin.exe, wbadmin.exe, duplicati.exe) or where the scheduled task name matches known backup job patterns (e.g., *Backup*, *Verify*).Scenario: A security team performs a controlled test of their EDR agent by deploying a benign canary file that intentionally contains one of the DCRat IOCs to verify detection coverage. The canary file is placed in a designated test directory and executed by a service account, triggering the rule as expected but resulting in a false positive in the production alert stream if not tagged.