ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving four specific indicators of compromise (IOCs) linked to the DCRat remote access Trojan, which is frequently used by threat actors to establish persistent command and control channels within compromised networks. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of DCRat deployment allows the SOC team to rapidly isolate affected endpoints before adversaries can exfiltrate sensitive data or pivot laterally across the environment.

IOC Summary

Malware Family: DCRat Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`202[.]95[.]9[.]108:8888`	botnet_cc	2026-07-27	100%
ip:port	`2[.]27[.]248[.]65:7777`	botnet_cc	2026-07-27	100%
ip:port	`137[.]220[.]155[.]44:12159`	botnet_cc	2026-07-27	75%
ip:port	`137[.]220[.]155[.]44:8848`	botnet_cc	2026-07-27	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["137.220.155.44", "2.27.248.65", "202.95.9.108"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["137.220.155.44", "2.27.248.65", "202.95.9.108"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Antivirus or EDR Full Scans
- Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black often perform scheduled full scans during off-hours. These agents may generate network traffic or process execution patterns that match DCRat’s specific IOCs, particularly if the scan involves deep packet inspection or file integrity monitoring on shared drives.
- Suggested Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe) and filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the source IP belongs to the internal management subnet.
Scenario: Automated Backup Agent Connectivity
- Context: Enterprise backup solutions such as Veeam Backup & Replication, Rubrik, or Commvault utilize agents that periodically connect to central repositories or cloud storage. These agents often use specific ports and protocols that may overlap with DCRat’s command-and-control (C2) signatures, triggering alerts when the agent establishes a heartbeat connection or initiates an incremental backup job.
- Suggested Filter/Exclusion: Exclude traffic originating from known Backup Agent Service Accounts (e.g., svc-veeam, commvault-agent) and restrict the alert to only trigger if the destination IP is not within the organization’s designated backup VLAN or cloud storage CIDR ranges.
Scenario: Patch Management Deployment Jobs
- Context: Tools like **Microsoft