ThreatFox: DCRat IOCs

Hunt Hypothesis

This hypothesis targets adversaries leveraging DCRat remote access trojans to establish persistent command-and-control channels for data exfiltration following initial phishing or malicious download compromises. Proactive hunting in Azure Sentinel is essential to identify early-stage infections and block suspicious outbound traffic to known DCRat IP:port combinations before attackers can execute lateral movement or sensitive data theft.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["45.207.222.132", "155.117.232.184"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.207.222.132", "155.117.232.184"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

False Positive Scenarios for “ThreatFox: DCRat IOCs” Rule

• Scenario: Legitimate Remote Desktop Administration via RDP

  • Context: System Administrators frequently use Microsoft Remote Desktop Protocol (RDP) or third-party tools like TeamViewer and AnyDesk to manage servers. These tools often establish outbound connections on ports commonly associated with DCRat’s command-and-control (C2) traffic (e.g., TCP 443, 8080, or specific high-range ephemeral ports). If the detection rule flags any connection to a known DCRat IP/Port combination without context, it may misidentify these standard admin sessions as malicious C2 activity.
  • Suggested Filter: Create an exclusion for traffic originating from Jump Hosts (Bastion hosts) or specific Admin Workstations (e.g., OU=IT-Admins in Active Directory). Additionally, filter out connections where the user agent string contains “RDP” or “TeamViewer” and the destination IP is within the enterprise’s trusted external partner range.

• Scenario: Scheduled Cloud Backup and Synchronization Jobs

  • Context: Enterprise environments utilize automated backup solutions like Veeam, Rubrik, or file synchronization tools such as OneDrive for Business and Google Drive. These services often run scheduled tasks (via Windows Task Scheduler) during off-hours that initiate outbound connections to cloud endpoints. If the DCRat rule monitors specific IP ranges used by these backup providers, the regular heartbeat or data exfiltration traffic from these jobs will trigger false alerts.
  • Suggested Filter: Implement a whitelist for known vendor IP ranges (e.g., Microsoft Azure Datacenters, AWS CloudFront IPs) and exclude traffic generated by processes with names like OneDrive.exe, VeeamTransportService.exe, or