ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the four known indicators of compromise (IOCs) associated with the DCRat remote access trojan to identify potential command-and-control communications or lateral movement within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of DCRat allows the SOC team to rapidly isolate compromised endpoints and prevent data exfiltration before the adversary establishes a persistent foothold.

IOC Summary

Malware Family: DCRat Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`192[.]253[.]245[.]178:2026`	botnet_cc	2026-07-29	75%
ip:port	`69[.]167[.]7[.]72:443`	botnet_cc	2026-07-29	100%
ip:port	`94[.]26[.]83[.]46:7777`	botnet_cc	2026-07-29	100%
ip:port	`103[.]85[.]225[.]138:7777`	botnet_cc	2026-07-29	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["69.167.7.72", "192.253.245.178", "94.26.83.46", "103.85.225.138"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["69.167.7.72", "192.253.245.178", "94.26.83.46", "103.85.225.138"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: DCRat IOCs detection rule:

Scenario 1: Automated Software Deployment via SCCM/Intune
- Context: Enterprise endpoints running Microsoft Endpoint Configuration Manager (SCCM) or Intune often download and install legitimate software updates. The deployment agents may generate network connections to public update servers that match DCRat’s known IP addresses or hash signatures used for distribution points.
- Suggested Filter/Exclusion: Exclude process executions where the parent process is ccmsetup.exe (SCCM) or Microsoft.IntuneManagementAgent.exe, and the destination IP belongs to the organization’s internal update server range or trusted CDN ranges (e.g., Microsoft Update domains).
Scenario 2: Scheduled Antivirus Definition Updates
- Context: Security suites like CrowdStrike Falcon, Symantec Endpoint Protection, or SentinelOne run scheduled jobs during off-hours to pull definition updates. These agents frequently connect to vendor update servers that may share the same IOCs (hashes or URLs) flagged by DCRat due to overlapping infrastructure or shared cloud storage buckets.
- Suggested Filter/Exclusion: Create an exclusion for alerts generated between 01:00 and 05:00 local time where the process name contains falcon.sys, Symantec, or SentinelOne, provided the destination port is standard HTTPS (443) and the traffic volume aligns with typical definition update sizes.
Scenario 3: Admin-Driven Cloud Backup Operations
- Context: System administrators often initiate manual backup jobs using tools like Veeam, Acronis Cyber Protect, or Azure Backup agents. These tools establish connections to cloud storage buckets (e.g., AWS S3, Azure Blob) that might utilize the same IP ranges