ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activities involving the seven known indicators of compromise (IOCs) linked to the PureRAT remote access trojan, which is frequently used for credential theft and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage infections and mitigate potential data exfiltration before the malware establishes persistence or spreads across the environment.

IOC Summary

Malware Family: PureRAT Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`27[.]124[.]36[.]136:56001`	botnet_cc	2026-08-04	75%
ip:port	`178[.]16[.]53[.]68:443`	botnet_cc	2026-08-04	75%
ip:port	`172[.]111[.]134[.]94:56011`	botnet_cc	2026-08-04	75%
ip:port	`172[.]111[.]134[.]94:56012`	botnet_cc	2026-08-04	75%
ip:port	`140[.]228[.]29[.]61:55555`	botnet_cc	2026-08-04	75%
ip:port	`104[.]251[.]181[.]111:443`	botnet_cc	2026-08-04	75%
ip:port	`104[.]239[.]66[.]36:443`	botnet_cc	2026-08-04	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["178.16.53.68", "104.239.66.36", "140.228.29.61", "172.111.134.94", "27.124.36.136", "104.251.181.111"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.16.53.68", "104.239.66.36", "140.228.29.61", "172.111.134.94", "27.124.36.136", "104.251.181.111"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Legitimate Software Deployment via SCCM/Intune
- Scenario: The Endpoint Protection or Configuration Management tool (e.g., Microsoft SCCM, Intune, or Ivanti) pushes a security update or application installer that contains a DLL or executable matching one of the PureRAT IOCs. This often occurs during scheduled maintenance windows where agents download and execute payloads from trusted internal repositories.
- Filter/Exclusion: Exclude alerts where the process parent is ccmexec.exe (SCCM), IntuneManagementExtension.exe, or IvantiAgent.exe. Additionally, filter out events originating from specific trusted internal IP subnets known to host deployment servers.
Scheduled Antivirus Definition Updates
- Scenario: A scheduled task runs nightly to update antivirus definitions (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender). The update package itself may include a component hash that coincidentally matches the PureRAT IOCs, triggering an alert during the automated scan cycle.
- Filter/Exclusion: Create an exclusion based on the Scheduled Task Name (e.g., “AntivirusDefinitionUpdate” or “DefenderUpdate”). Alternatively, suppress alerts if the process path resides within the vendor’s default installation directory (e.g., C:\Program Files\Microsoft Defender Antivirus\).
IT Admin Remote Management Sessions
- Scenario: An IT administrator uses a remote management tool like BeyondTrust or ConnectWise Control to access a workstation. The session involves launching a diagnostic utility or script that utilizes a shared library matching the PureRAT signature, often triggered by user interaction rather than malicious background activity.
- **Filter/Exclusion