This hunt targets the presence of known DCRat IOCs to identify potential ransomware activity or initial access footholds within the environment. Proactively hunting for these indicators allows the SOC to detect and isolate compromised assets before the adversary can deploy the DCRat payload to encrypt data or establish persistence.
Malware Family: DCRat Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 181[.]206[.]118[.]219:5118 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 146[.]70[.]51[.]74:2512 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 128[.]241[.]244[.]3:12159 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 128[.]241[.]244[.]3:8848 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 128[.]241[.]244[.]7:12159 | botnet_cc | 2026-09-19 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["181.206.118.219", "128.241.244.7", "128.241.244.3", "146.70.51.74"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["181.206.118.219", "128.241.244.7", "128.241.244.3", "146.70.51.74"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
svc-reporting) or the host group Legacy-App-Servers from the IOC match if the process name is java.exe and the parent is w3wp.exe or cmd.exe.BackupService account or those with a parent process of vssadmin.exe/commvault.exe when the IOC type is “File Hash” or “Memory String”.Environment=Dev or Environment=QA, or exclude user accounts ending in -dev or -qa when the IOC involves network connections to internal IP ranges.powershell.exe and the command line contains -ExecutionPolicy Bypass or specific log path patterns (e.g., C:\Logs\), or exclude the specific scheduled task name DailyLogCleanup.