ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt identifies potential PureRAT infections by correlating network traffic with known indicators of compromise, targeting adversaries who leverage this remote access trojan to establish persistent control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical because PureRAT often operates silently to facilitate data exfiltration and lateral movement, allowing the SOC to detect and isolate threats before they escalate into full-blown ransomware or advanced persistent threat campaigns.

IOC Summary

Malware Family: PureRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["217.60.195.193"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.195.193"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureRAT

False Positive Guidance

• Scenario: A DevOps engineer uses a script to automate the deployment of a lightweight monitoring agent (e.g., a custom PowerShell wrapper for netstat or tasklist) that inadvertently matches the specific hash or registry key associated with PureRAT’s persistence mechanism.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the command line contains specific deployment flags (e.g., -Install or -Deploy) within the C:\Scripts\ or C:\Deploy\ directories.
• Scenario: An IT administrator runs a standard Windows maintenance task using schtasks.exe to clean up temporary files, which creates a scheduled task entry with a name or GUID that coincidentally matches one of the IOCs in the ThreatFox package (e.g., a generic name like “SystemCleanup” or a specific GUID used by a third-party backup tool like Veeam or Commvault).
  • Filter/Exclusion: Exclude scheduled tasks where the task path is under \Microsoft\Windows\ or known third-party vendor paths (e.g., \Veeam\, \Commvault\), or where the task action executable is a known signed binary (e.g., cleanup.exe from C:\Program Files\...).
• Scenario: A security team performs a periodic vulnerability scan using a tool like Nessus or Qualys, which spawns temporary processes or writes specific registry keys to test for known RAT persistence locations, triggering the IOC match during the scan window.
  • Filter/Exclusion: Exclude events occurring within a defined time window (e.g., 02:00–04:00 AM) where the source IP or hostname is in the scan-lab or vuln-scan AD group, or where the process name is `nessus.exe