ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the DCRat remote access trojan by identifying specific indicators of compromise such as unique file hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical to rapidly identify early-stage infections that could lead to unauthorized data exfiltration or lateral movement within the enterprise environment.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["45.59.120.82", "130.12.181.96"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.59.120.82", "130.12.181.96"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

False Positive Scenarios for “ThreatFox: DCRat IOCs” Rule

• Scenario: Legitimate Remote Administration via PowerShell

  • Context: System administrators frequently use PowerShell to execute remote scripts that download configuration files or patches from internal repositories. If the downloaded artifact (e.g., a .dll or .exe) shares a hash or network signature with DCRat’s known IOCs, the rule triggers. This often occurs during scheduled maintenance windows where admins push updates using tools like SCCM or PowerShell Remoting.
  • Suggested Filter: Exclude processes initiated by powershell.exe when the parent process is a known management tool (e.g., ccmexec.exe, taskeng.exe) and the network destination IP belongs to the internal corporate subnet.

• Scenario: Scheduled Antivirus or EDR Definition Updates

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black perform periodic definition updates. These agents often download update packages from vendor cloud endpoints that may utilize similar cryptographic signatures or network patterns as the DCRat IOCs, particularly if the vendor’s update server shares a certificate chain or IP range with the threat intelligence feed.
  • Suggested Filter: Create an exclusion for processes named C:\Program Files\Microsoft Defender\MsMpEng.exe (or equivalent EDR service executables) when the network connection is directed to known vendor update domains (e.g., *.microsoft.com, *.carbonblack.com).

• Scenario: Internal DevOps Artifact Deployment

  • Context: In CI/CD pipelines, internal build servers often deploy application artifacts using tools like Jenkins, Azure DevOps, or GitHub Actions. These agents download and execute binaries that might contain similar code