ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis detects adversary behavior involving the deployment of PureRAT remote access trojans by monitoring for specific Indicators of Compromise (IOCs) that signal active reconnaissance or lateral movement within the network. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections and prevent potential data exfiltration or command-and-control communications before they escalate into broader compromises.

IOC Summary

Malware Family: PureRAT Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`91[.]92[.]42[.]22:443`	botnet_cc	2026-08-10	75%
ip:port	`209[.]99[.]190[.]23:56014`	botnet_cc	2026-08-10	75%
ip:port	`104[.]239[.]66[.]245:443`	botnet_cc	2026-08-10	75%
ip:port	`154[.]29[.]72[.]36:6000`	botnet_cc	2026-08-10	75%
ip:port	`204[.]77[.]130[.]227:56001`	botnet_cc	2026-08-10	75%
ip:port	`204[.]77[.]130[.]227:56002`	botnet_cc	2026-08-10	75%
ip:port	`204[.]77[.]130[.]227:56003`	botnet_cc	2026-08-10	75%
ip:port	`91[.]219[.]238[.]82:56001`	botnet_cc	2026-08-10	99%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["104.239.66.245", "91.219.238.82", "209.99.190.23", "91.92.42.22", "154.29.72.36", "204.77.130.227"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.239.66.245", "91.219.238.82", "209.99.190.23", "91.92.42.22", "154.29.72.36", "204.77.130.227"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Backup Script Execution
- Context: A nightly scheduled task running a PowerShell script to back up user profiles often executes powershell.exe with arguments that match the PureRAT IOCs (specifically network connection patterns or specific hash values used by common backup tools).
- Filter/Exclusion: Create an exclusion rule for the process path C:\Program Files\BackupAgent\Scripts\DailyBackup.ps1. Additionally, filter out alerts where the parent process is Task Scheduler (svchost.exe) and the execution time falls within the defined maintenance window (e.g., 02:00–04:00).
Scenario: Endpoint Protection Agent Updates
- Context: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled definition update. The update agent may download and execute a component that shares the same file hash or network destination IP as one of the PureRAT IOCs.
- Filter/Exclusion: Exclude alerts where the process name matches FalconService.exe (CrowdStrike) or MsMpEng.exe (Defender). If the IOC is a specific URL, add the vendor’s update distribution domain (e.g., *.falcon.crowdstrike.com) to the allow-list.
Scenario: Admin Remote Session via RDP
- Context: A System Administrator initiates a remote desktop session using a custom PowerShell wrapper script to deploy configuration changes across multiple servers. This script invokes specific commands that trigger the IOCs associated with PureRAT’s command-line execution patterns.
- **Filter/Exclusion