ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of DCRat remote access trojan indicators to establish persistent command and control channels within the network. The SOC team should proactively hunt for these IOCs in Azure Sentinel because early identification of DCRat activity allows for rapid containment before attackers can exfiltrate sensitive data or move laterally across critical assets.

IOC Summary

Malware Family: DCRat Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`206[.]123[.]129[.]171:7720`	botnet_cc	2026-08-06	75%
ip:port	`186[.]169[.]88[.]130:9031`	botnet_cc	2026-08-06	75%
ip:port	`64[.]89[.]161[.]65:4444`	botnet_cc	2026-08-06	100%
ip:port	`104[.]243[.]47[.]67:8080`	botnet_cc	2026-08-06	100%
ip:port	`160[.]20[.]109[.]29:8080`	botnet_cc	2026-08-06	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["160.20.109.29", "104.243.47.67", "64.89.161.65", "206.123.129.171", "186.169.88.130"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["160.20.109.29", "104.243.47.67", "64.89.161.65", "206.123.129.171", "186.169.88.130"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Legitimate Backup Agent Scanning via Windows Scheduled Tasks
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) often run scheduled jobs that scan directories containing DCRat-related artifacts or utilize similar file hashes during the backup process. If a backup agent scans a directory where a legitimate DCRat tool is installed for monitoring purposes, it may trigger the IOC match.
- Filter/Exclusion: Create an exclusion rule to suppress alerts when the parent process is VeeamAgent.exe or CommServe.exe. Additionally, exclude matches occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where backup jobs are active.
Scenario: Endpoint DLP and Antivirus Real-Time Scanning
- Context: Data Loss Prevention (DLP) agents like Symantec DLP or McAfee Total Protection frequently perform real-time file integrity checks on user workstations. If a user downloads a legitimate document or application that shares a hash with one of the 5 DCRat IOCs, the EDR/DLP engine’s scanning process will generate the alert.
- Filter/Exclusion: Filter out alerts where the initiating process is SymantecDlpAgent.exe or mfeesp.exe. Furthermore, exclude matches on file paths located within standard “Downloads” folders (C:\Users\<User>\Downloads\) to reduce noise from transient user downloads.
Scenario: Internal DevOps Pipeline Artifact Deployment
- Context: In CI/CD environments using tools like Jenkins or Azure DevOps, build agents often deploy artifacts containing shared libraries or configuration files that match