ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior involving the deployment of DCRat remote access tools by identifying specific indicators of compromise within network and endpoint telemetry. A SOC team should proactively hunt for these IOCs in Azure Sentinel to detect early-stage lateral movement or command-and-control communications that often precede data exfiltration or ransomware attacks.

IOC Summary

Malware Family: DCRat Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["141.94.121.162", "45.59.120.79"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["141.94.121.162", "45.59.120.79"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Internal Vulnerability Scanner Activity

  • Context: Enterprise vulnerability management tools like Tenable Nessus, Qualys, or Rapid7 InsightVM frequently scan endpoints. These scanners often download specific DCRat-related signature updates, configuration files, or probe scripts that match the rule’s IOCs (e.g., specific file hashes or network connections) during routine scans.
  • Filter/Exclusion: Create an exclusion rule based on the Source Process Name and User Context. Exclude alerts where the process is Tenable.Nessus.Agent.exe, QualysPCAgent.exe, or Rapid7.Agent.exe AND the user context is a local system account (e.g., NT AUTHORITY\SYSTEM) or a dedicated service account (e.g., svc-vuln-scan).

• Scenario: Scheduled Endpoint Protection Updates

  • Context: Security suites such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black often utilize DCRat IOCs within their own update mechanisms. During scheduled maintenance windows (e.g., nightly at 02:00 AM), these agents may download definition packs that contain the exact file hashes or network signatures flagged by the rule.
  • Filter/Exclusion: Implement a time-based exclusion combined with process filtering. Exclude alerts occurring between 01:30 and 04:00 on weekdays where the initiating process is C:\Program Files\CrowdStrike\FalconSensor.exe or C:\Windows\System32\DefenderService.exe.

• Scenario: Admin Deployment via Configuration Management Tools

  • Context: IT