ThreatFox: DCRat IOCs

Hunt Hypothesis

This detection identifies active DCRat Remote Access Trojan infections by matching network and endpoint telemetry against known ThreatFox indicators of compromise, signaling potential unauthorized remote control capabilities within the environment. Proactive hunting for this behavior in Azure Sentinel is critical to rapidly isolate compromised hosts before adversaries leverage the RAT’s stealthy command-and-control channels to establish persistent access or exfiltrate sensitive data.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["172.111.232.133", "104.223.98.68"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.111.232.133", "104.223.98.68"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including context and suggested exclusions:

• Scenario: Legitimate Remote Support Sessions via TeamViewer or AnyDesk

  • Context: Enterprise helpdesk teams frequently use remote access tools like TeamViewer, AnyDesk, or Splashtop to troubleshoot user workstations. These applications often establish persistent connections and download configuration files that match the network signatures of DCRat’s command-and-control (C2) beacons, triggering false alerts on ports 5938-5940 or specific hash values.
  • Suggested Filter: Create an exclusion rule for traffic originating from known Helpdesk IP ranges destined to approved remote support domains (e.g., *.teamviewer.com, *.anydesk.com). Additionally, exclude processes with file paths containing \Program Files\TeamViewer\ or \Program Files\AnyDesk\.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites such as Microsoft Defender, CrowdStrike Falcon, or Symantec Endpoint Protection run scheduled jobs (typically at 02:00 AM) to download definition updates. The update agents often utilize similar TLS handshakes and file hashes that overlap with DCRat’s initial infection payload, causing the rule to flag these routine maintenance windows as potential malware activity.
  • Suggested Filter: Implement a time-based exclusion for the detection logic during defined maintenance windows (e.g., Mon-Fri, 01:30–04:30). Alternatively, exclude specific process names like MsMpEng.exe, Cfssvc.exe, or Symantec Endpoint Protection Client from triggering this rule.

• Scenario: Automated Software Deployment via SCCM or Intune