ThreatFox: Overlord RAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Overlord RAT to establish covert command-and-control channels through specific IP:port pairs following initial compromise via phishing or exploit kits. Proactive hunting in Azure Sentinel is critical to detect early-stage lateral movement and data exfiltration attempts before attackers can fully manipulate systems and extract sensitive information.

IOC Summary

Malware Family: Overlord RAT Total IOCs: 11 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]92[.]1[.]46:5173`	botnet_cc	2026-07-30	50%
ip:port	`176[.]96[.]139[.]116:5173`	botnet_cc	2026-07-30	50%
ip:port	`194[.]26[.]192[.]210:5173`	botnet_cc	2026-07-30	50%
ip:port	`135[.]181[.]128[.]187:443`	botnet_cc	2026-07-30	50%
ip:port	`64[.]89[.]163[.]84:5173`	botnet_cc	2026-07-30	50%
ip:port	`104[.]249[.]10[.]76:5173`	botnet_cc	2026-07-30	50%
ip:port	`85[.]11[.]167[.]56:5173`	botnet_cc	2026-07-30	50%
ip:port	`77[.]110[.]110[.]117:5173`	botnet_cc	2026-07-30	50%
ip:port	`193[.]233[.]126[.]136:5173`	botnet_cc	2026-07-30	50%
ip:port	`104[.]249[.]10[.]18:5173`	botnet_cc	2026-07-30	50%
ip:port	`89[.]19[.]223[.]95:5173`	botnet_cc	2026-07-30	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Overlord RAT
let malicious_ips = dynamic(["104.249.10.18", "135.181.128.187", "64.89.163.84", "77.110.110.117", "194.26.192.210", "104.249.10.76", "89.19.223.95", "176.96.139.116", "45.92.1.46", "193.233.126.136", "85.11.167.56"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.249.10.18", "135.181.128.187", "64.89.163.84", "77.110.110.117", "194.26.192.210", "104.249.10.76", "89.19.223.95", "176.96.139.116", "45.92.1.46", "193.233.126.136", "85.11.167.56"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Overlord RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Overlord RAT IOCs detection rule, including targeted filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Cloud Backup Agent Communication
- Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often establish persistent outbound connections to cloud storage gateways (e.g., AWS S3, Azure Blob) using specific IP:port pairs that may overlap with Overlord RAT signatures. These agents run as scheduled tasks during off-hours to exfiltrate large data sets.
- Filter/Exclusion: Create an exclusion rule for the process names VeeamAgent.exe, rubrik-agent.exe, and vssvc.exe. Filter traffic where the destination IP belongs to known cloud provider CIDR blocks (e.g., 169.254.x.x or specific AWS/Azure ranges) and the connection duration exceeds 30 minutes, indicating a bulk transfer rather than a covert RAT beacon.
Scenario: Microsoft Office 365 Telemetry and Update Services
- Context: The Microsoft Office Click-to-Run Service (OfficeClickToRun.exe) and Windows Update (wuauserv) frequently initiate outbound connections to Microsoft’s global content delivery network (CDN) IPs. These services communicate over standard HTTPS ports but can trigger alerts if the specific IP:port combination matches Overlord’s known command-and-control patterns, especially during major patch deployment windows.
- Filter/Exclusion: Exclude traffic originating from Microsoft Office Click-to-Run.exe and svchost.exe (specific to Windows Update) where the destination domain resolves to *.office365.com, *.microsoft.com, or *.update.microsoft.com. Additionally, filter out connections occurring strictly between 02:00