ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the deployment of PureRAT remote access tools by monitoring for specific indicators of compromise known to facilitate persistent command and control communications. Proactive hunting in Azure Sentinel is critical because PureRAT’s stealthy nature often evades standard signature-based detection, requiring manual correlation of these high-severity IOCs to prevent potential data exfiltration or lateral movement within the environment.

IOC Summary

Malware Family: PureRAT Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`80[.]76[.]49[.]38:443`	botnet_cc	2026-08-03	75%
ip:port	`207[.]56[.]28[.]111:56002`	botnet_cc	2026-08-03	75%
ip:port	`207[.]56[.]28[.]111:56001`	botnet_cc	2026-08-03	75%
ip:port	`135[.]136[.]132[.]74:55555`	botnet_cc	2026-08-03	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["135.136.132.74", "207.56.28.111", "80.76.49.38"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["135.136.132.74", "207.56.28.111", "80.76.49.38"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Endpoint Protection Console Updates
- Context: The organization’s primary endpoint security suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads definition updates or agent configuration changes via a scheduled task. These update packages often contain hashes or network connections that overlap with PureRAT’s known IOCs, particularly regarding certificate validation and specific DLL loading patterns.
- Filter/Exclusion: Exclude processes originating from the endpoint security vendor’s service accounts (e.g., FalconService.exe, MsMpEng.exe) running under the SYSTEM or dedicated EndpointAdmin user context. Add a filter to ignore alerts where the parent process is the known update orchestrator and the execution path matches the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\...).
Scenario: Scheduled PowerShell Backup Jobs
- Context: A nightly scheduled job utilizing PowerShell (powershell.exe) runs a backup script that invokes external tools for data compression or encryption. If the backup tool uses specific libraries or network endpoints similar to PureRAT’s C2 infrastructure, the detection logic may flag the legitimate script execution as suspicious.
- Filter/Exclusion: Create an exclusion rule based on the Scheduled Task name (e.g., “DailyDBBackup” or “Office365Sync”) and the specific hash of the backup utility binary. Ensure the filter validates that the PowerShell command line arguments contain known keywords like -File, -ExecutionPolicy Bypass, and reference specific internal file paths rather than generic temporary directories often used by malware.
Scenario: Third-Party Remote Support Tools
- Context: IT Helpdesk teams utilize remote