ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets known indicators of compromise associated with PureRAT, a remote access trojan frequently used by threat actors to establish persistent control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the adversary can leverage the RAT for lateral movement, data exfiltration, or further payload delivery.

IOC Summary

Malware Family: PureRAT Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`80[.]76[.]49[.]209:443`	botnet_cc	2026-09-18	75%
ip:port	`45[.]139[.]104[.]222:55006`	botnet_cc	2026-09-18	75%
ip:port	`45[.]139[.]104[.]26:55011`	botnet_cc	2026-09-18	75%
ip:port	`45[.]139[.]104[.]222:443`	botnet_cc	2026-09-18	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["45.139.104.222", "45.139.104.26", "80.76.49.209"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.139.104.222", "45.139.104.26", "80.76.49.209"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a custom Java-based monitoring agent that shares a specific SHA256 hash or MD5 with a known PureRAT build due to a shared library or compiler version.
- Filter/Exclusion: Exclude processes where the parent process is java.exe or dotnet.exe and the working directory is under C:\Jenkins\workspace\ or C:\github\actions-runner\.
Scenario: An IT administrator installs a legacy third-party RMM (Remote Monitoring and Management) tool (e.g., Datto RMM or N-able) that uses a specific Mutex name (e.g., PureRAT_Mutex) for inter-process communication, which collides with the IOCs in the hunt package.
- Filter/Exclusion: Exclude events where the process name is RMMAgent.exe or NableAgent.exe and the user account belongs to the IT_Admins security group.
Scenario: A security team runs a scheduled vulnerability scan using a tool like Nessus or Qualys that temporarily creates a file with a known PureRAT File Path (e.g., %TEMP%\pure_update.exe) to test persistence mechanisms during a red team exercise.
- Filter/Exclusion: Exclude file creation events where the parent process is nessus.exe or qualys_agent.exe and the timestamp falls within the defined maintenance window (e.g., Sundays 02:00–04:00).
Scenario: A developer compiles a C++ application using MinGW, which generates a binary with a specific Import Table entry or Section Name that matches one of the PureRAT IOCs due to a common compiler