ThreatFox: Ghost RAT IOCs

Hunt Hypothesis

This hunt targets the presence of Ghost RAT, a remote access trojan that adversaries deploy to establish persistent remote control and exfiltrate sensitive data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy infections before the attacker leverages the backdoor for lateral movement or data exfiltration.

IOC Summary

Malware Family: Ghost RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Ghost RAT
let malicious_ips = dynamic(["156.225.17.60"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.225.17.60"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Ghost RAT

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a specific version of a Ghost RAT sample (e.g., ghost.exe) into a temporary directory (C:\Temp\) for sandbox analysis or threat hunting validation, triggering the IOC match on the file path or hash.
  • Filter/Exclusion: Exclude file paths containing \Temp\, \Downloads\, or specific threat hunting directories (e.g., C:\ThreatHunt\) if the parent process is cmd.exe, powershell.exe, or curl.exe and the file age is less than 24 hours.
• Scenario: An IT administrator runs a scheduled PowerShell script to clean up old logs or temporary files, which inadvertently deletes or moves a file named ghost.dll or ghost.exe that was previously used as a placeholder or test artifact in a development environment.
  • Filter/Exclusion: Exclude events where the action is “Delete” or “Move” and the source process is powershell.exe or cmd.exe with a scheduled task ID (e.g., Task Scheduler or cron equivalent) associated with the execution context.
• Scenario: A security team performs a red team exercise or purple team drill, deploying a benign copy of Ghost RAT (or a similar RAT with identical IOCs) to test detection coverage, resulting in legitimate alerts during the exercise window.
  • Filter/Exclusion: Implement a time-based exclusion or tag-based suppression for assets or users tagged with RedTeam or PurpleTeam during known exercise windows, or exclude events where the user account belongs to the RedTeam security group.
• Scenario: A backup agent or endpoint DLP tool scans and quarantines a file matching Ghost RAT IOCs (e.g., ghost.rat or specific hash) that was