ThreatFox: DCRat IOCs

Hunt Hypothesis

This detection rule identifies active DCRat remote access trojan infections by monitoring network and endpoint telemetry against a curated set of 13 known indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly detect early-stage lateral movement and command-and-control communications, enabling the SOC team to contain potential data exfiltration before adversaries establish persistent footholds.

IOC Summary

Malware Family: DCRat Total IOCs: 13 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["156.247.47.109", "47.129.159.160", "12.187.175.73", "46.246.12.2", "158.94.211.191", "156.247.47.106", "156.247.47.108", "195.20.115.53", "156.247.47.110"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.247.47.109", "47.129.159.160", "12.187.175.73", "46.246.12.2", "158.94.211.191", "156.247.47.106", "156.247.47.108", "195.20.115.53", "156.247.47.110"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Legitimate Backup Operations via Veeam or Commvault

  • Context: Enterprise backup agents (e.g., Veeam Agent, Commvault) frequently generate process trees with high I/O activity and network connections that mimic DCRat’s command-and-control (C2) behavior. The detection logic may flag the specific file hashes or registry keys used by these backup tools as matches for DCRat IOCs.
  • Filter/Exclusion: Create a filter to exclude alerts where the parent process is vbr.exe (Veeam), simservice.exe (Commvault), or sqlbackupagent.exe. Additionally, add an exclusion rule for network connections originating from backup service accounts (e.g., DOMAIN\BackupSvc) connecting to known internal IP ranges of the backup infrastructure.

• Scenario: Scheduled PowerShell Script Execution by IT Admins

  • Context: Administrative tasks scheduled via Task Scheduler often involve PowerShell scripts that query external APIs or download configuration files. If a script executes from a standard admin workstation and accesses a URL matching DCRat’s C2 domain pattern, the rule may trigger due to overlapping network signatures or file hash collisions in the script directory (C:\Windows\System32\WindowsPowerShell\v1.0).
  • Filter/Exclusion: Implement an exclusion for alerts where the process name is powershell.exe and the command line contains specific keywords like -ExecutionPolicy Bypass, -File, or paths ending in \Scripts\. Furthermore, exclude traffic from known internal admin subnets (e.g., 10.20.x.x) during business hours if the destination IP is a trusted public CDN or software vendor.