ThreatFox: DCRat IOCs

Hunt Hypothesis

The detection identifies potential DCRat malware activity through known IOCs, indicating an adversary may be establishing persistence or exfiltrating data. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats before significant data loss occurs.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["64.89.161.156", "191.93.116.106"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.89.161.156", "191.93.116.106"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

• Scenario: Legitimate system update using Microsoft Update
  Filter/Exclusion: process.name != "wuauclt.exe" or process.name != "svchost.exe" (when specifically associated with Windows Update)

• Scenario: Scheduled backup job using Veeam Backup & Replication
  Filter/Exclusion: process.name != "veeambackup.exe" or process.name != "vmbackup.exe" (when running scheduled backups)

• Scenario: Admin task using PowerShell for log management with LogParser
  Filter/Exclusion: process.name != "logparser.exe" or process.name != "powershell.exe" (when executing legitimate log analysis scripts)

• Scenario: Database maintenance task using SQL Server Agent job
  Filter/Exclusion: process.name != "sqlservr.exe" or process.name != "sqlagent.exe" (when running scheduled maintenance tasks)

• Scenario: Network monitoring tool using Wireshark for packet capture
  Filter/Exclusion: process.name != "wireshark.exe" or process.name != "tshark.exe" (when capturing network traffic for analysis)