ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the DCRat remote access trojan by identifying specific indicators of compromise such as malicious file hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical to uncover early-stage lateral movement or command-and-control communications that may evade standard signature-based detection.

IOC Summary

Malware Family: DCRat Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["213.165.69.19", "91.92.40.194", "176.97.114.8"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["213.165.69.19", "91.92.40.194", "176.97.114.8"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Agent Scanning

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often scan large directories of user data. If the DCRat IOCs include specific file hashes or network destinations used by these agents (e.g., a known update server IP), the backup process might trigger alerts when accessing legacy configuration files containing similar signatures.
  • Filter/Exclusion: Create an exclusion rule to suppress alerts for processes running under the Veeam.Backup.Service.exe or commvault.cmd user context, specifically when the source port is within the standard backup range (e.g., 9400-9500) and the destination IP matches the known Veeam/Commvault update repository.

• Scenario: Scheduled PowerShell Health Checks

  • Context: IT Operations teams frequently deploy scheduled tasks using Windows Task Scheduler to run custom PowerShell scripts (powershell.exe) that query internal monitoring dashboards or perform inventory checks. If these scripts invoke a specific HTTP library or download a signature file matching one of the DCRat IOCs, it generates a false hit during the nightly maintenance window (e.g., 02:00 – 04:00).
  • Filter/Exclusion: Implement a time-based filter to exclude alerts generated between 01:30 and 05:30 on weekdays for powershell.exe processes initiated by the local system account (NT AUTHORITY\SYSTEM) or a dedicated service account (e.g., svc-healthcheck).

• Scenario: Endpoint Protection Definition Updates

  • Context: Major EDR solutions