This detection rule identifies adversary activity involving the SectopRAT remote access tool by matching against a curated set of 20 specific indicators of compromise. SOC teams should proactively hunt for these IOCs in Azure Sentinel to rapidly uncover and contain potential lateral movement or command-and-control communications associated with this high-severity threat.
Malware Family: SectopRAT Total IOCs: 20 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 87[.]199[.]194[.]37:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 195[.]63[.]138[.]10:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 89[.]110[.]68[.]28:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 94[.]26[.]83[.]204:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 193[.]233[.]126[.]38:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 145[.]63[.]134[.]238:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 212[.]43[.]156[.]153:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 45[.]227[.]254[.]42:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 77[.]105[.]136[.]187:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 89[.]124[.]93[.]136:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 151[.]59[.]106[.]134:8080 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 151[.]59[.]116[.]121:8080 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 89[.]124[.]88[.]186:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 45[.]158[.]196[.]127:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 212[.]43[.]159[.]144:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 38[.]83[.]53[.]106:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 145[.]63[.]128[.]52:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 45[.]227[.]254[.]32:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 38[.]146[.]25[.]27:9000 | botnet_cc | 2026-07-30 | 75% |
| ip:port | 212[.]43[.]156[.]21:9000 | botnet_cc | 2026-07-30 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - SectopRAT
let malicious_ips = dynamic(["38.83.53.106", "89.124.88.186", "145.63.134.238", "145.63.128.52", "212.43.159.144", "77.105.136.187", "212.43.156.153", "45.227.254.42", "89.124.93.136", "45.227.254.32", "151.59.116.121", "94.26.83.204", "151.59.106.134", "38.146.25.27", "45.158.196.127", "212.43.156.21", "87.199.194.37", "89.110.68.28", "195.63.138.10", "193.233.126.38"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.83.53.106", "89.124.88.186", "145.63.134.238", "145.63.128.52", "212.43.159.144", "77.105.136.187", "212.43.156.153", "45.227.254.42", "89.124.93.136", "45.227.254.32", "151.59.116.121", "94.26.83.204", "151.59.106.134", "38.146.25.27", "45.158.196.127", "212.43.156.21", "87.199.194.37", "89.110.68.28", "195.63.138.10", "193.233.126.38"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: SectopRAT IOCs detection rule, along with targeted filters or exclusions to mitigate noise in an enterprise environment:
Endpoint Protection Policy Updates via Admin Console
mpcmdrun.exe (Defender) or FalconSensorService.exe (CrowdStrike) and the file path resides within the vendor’s installation directory (e.g., C:\Program Files\Microsoft Defender Antivirus\).Third-Party Vulnerability Scanning Jobs
QualysPCAgent or TenableNessus service accounts that execute within the specific time window of 02:00–04:00 UTC, filtering out events where the file extension is .xml or .json (common feed formats).Software Deployment via Configuration Management