The hunt hypothesis detects potential SectopRAT malware activity through identified IOCs, indicating an adversary may be establishing persistence or exfiltrating data. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced persistent threats before significant damage occurs.
IOC Summary
Malware Family: SectopRAT Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 2[.]27[.]5[.]12:9000 | botnet_cc | 2026-05-22 | 100% |
| ip:port | 5[.]188[.]86[.]6:9000 | botnet_cc | 2026-05-22 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - SectopRAT
let malicious_ips = dynamic(["5.188.86.6", "2.27.5.12"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["5.188.86.6", "2.27.5.12"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Legitimate scheduled job using schtasks.exe to run a maintenance script
Filter/Exclusion: Exclude processes initiated by schtasks.exe with known legitimate command-line arguments (e.g., schtasks /run /tn "Disk Cleanup")
Scenario: Admin using PowerShell to execute a script for system monitoring
Filter/Exclusion: Exclude PowerShell scripts executed from known trusted locations (e.g., C:\Windows\System32\) or with known admin tools like PSMonitor
Scenario: Network discovery tool like Nmap performing a port scan
Filter/Exclusion: Exclude network scans initiated from known security tools (e.g., nmap -sV 192.168.1.0/24) or from the security team’s IP range
Scenario: Log management tool like Splunk or ELK indexing logs
Filter/Exclusion: Exclude processes related to log collection tools (e.g., splunkforwarder, logstash, or filebeat) running under the splunk or logstash user
Scenario: Antivirus or EDR tool performing a full system scan
Filter/Exclusion: Exclude processes associated with known security software (e.g., Microsoft Defender, CrowdStrike, or SentinelOne) running under their respective service accounts