This hunt detects adversary activity involving the PureRAT remote access trojan by identifying matches against a curated set of eleven specific indicators of compromise within Azure Sentinel logs. Proactively hunting for these IOCs is critical to rapidly identify and contain early-stage infections that could lead to unauthorized data exfiltration or persistent command-and-control communication.
Malware Family: PureRAT Total IOCs: 11 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 94[.]154[.]32[.]48:443 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 88[.]214[.]26[.]49:443 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 209[.]99[.]190[.]23:56013 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 207[.]174[.]0[.]234:443 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 196[.]64[.]146[.]72:443 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 196[.]251[.]107[.]131:56001 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 196[.]251[.]107[.]131:56002 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 196[.]251[.]107[.]131:56003 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 87[.]58[.]197[.]40:56001 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 87[.]58[.]197[.]40:56002 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 87[.]58[.]197[.]40:56003 | botnet_cc | 2026-08-06 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["207.174.0.234", "87.58.197.40", "196.64.146.72", "94.154.32.48", "196.251.107.131", "209.99.190.23", "88.214.26.49"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["207.174.0.234", "87.58.197.40", "196.64.146.72", "94.154.32.48", "196.251.107.131", "209.99.190.23", "88.214.26.49"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: PureRAT IOCs detection rule in an enterprise environment:
Scenario: Endpoint Protection Console Updates
MsMpEng.exe, FalconSensorService.exe) and restrict the alert to exclude traffic originating from the Internal Management Subnet where the update server resides.Scenario: Scheduled PowerShell Automation Jobs
powershell.exe with specific command-line arguments that inadvertently match the IOCs associated with PureRAT’s command-and-control behavior.svchost.exe or TaskSchedulerService.exe, and the User Account belongs to a specific “Service Accounts” security group (e.g., DOMAIN\svc-automation-*).Scenario: Third-Party Backup Agent Communication