ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of PureRAT remote access trojans by monitoring network and endpoint telemetry against a curated set of 15 specific indicators of compromise. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage lateral movement and command-and-control communications that may evade standard signature-based detections, ensuring rapid containment of potential data exfiltration or persistent access threats.

IOC Summary

Malware Family: PureRAT Total IOCs: 15 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	85[.]11[.]167[.]134:56001	botnet_cc	2026-08-01	75%
ip:port	85[.]11[.]167[.]134:56002	botnet_cc	2026-08-01	75%
ip:port	31[.]57[.]38[.]232:443	botnet_cc	2026-08-01	75%
ip:port	217[.]60[.]195[.]197:56002	botnet_cc	2026-08-01	75%
ip:port	217[.]60[.]195[.]197:56001	botnet_cc	2026-08-01	75%
ip:port	192[.]159[.]99[.]70:56002	botnet_cc	2026-08-01	75%
ip:port	192[.]159[.]99[.]70:56001	botnet_cc	2026-08-01	75%
ip:port	104[.]251[.]181[.]111:56001	botnet_cc	2026-08-01	75%
ip:port	104[.]251[.]181[.]111:56002	botnet_cc	2026-08-01	75%
ip:port	103[.]148[.]58[.]8:56002	botnet_cc	2026-08-01	75%
ip:port	103[.]148[.]58[.]10:56001	botnet_cc	2026-08-01	75%
ip:port	103[.]148[.]58[.]10:56002	botnet_cc	2026-08-01	75%
ip:port	103[.]148[.]58[.]18:56001	botnet_cc	2026-08-01	75%
ip:port	103[.]148[.]58[.]18:56002	botnet_cc	2026-08-01	75%
ip:port	103[.]148[.]58[.]8:56001	botnet_cc	2026-08-01	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["192.159.99.70", "31.57.38.232", "85.11.167.134", "103.148.58.8", "104.251.181.111", "103.148.58.10", "217.60.195.197", "103.148.58.18"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.159.99.70", "31.57.38.232", "85.11.167.134", "103.148.58.8", "104.251.181.111", "103.148.58.10", "217.60.195.197", "103.148.58.18"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled

References

• ThreatFox — PureRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Legitimate Endpoint Management Traffic (Microsoft Intune/SCCM)

  • Scenario: The PureRAT IOCs include specific hashes or network destinations often used by Microsoft’s endpoint management suite. When the Intune Management Extension or Configuration Manager (SCCM) Client Agent performs a scheduled policy update or software deployment, it may contact these same external endpoints, triggering an alert due to matching network flow or process hash signatures.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name and Parent Process. Exclude alerts where the parent process is Microsoft.IntuneManagementExtension.exe, ccmexec.exe, or wsman.exe (Windows Service Host) originating from the C:\Program Files\Microsoft Intune Management Extension\ directory.

• Scheduled Security Scans by Third-Party Antivirus

  • Scenario: Enterprise environments often utilize third-party EDR solutions like CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection. During their scheduled deep-scan cycles, these agents may download definition updates or telemetry data from cloud repositories that share the same IP ranges or file hashes identified in the PureRAT IOC set.
  • Filter/Exclusion: Implement a time-based exclusion for alerts generated between 02:00 and 04:00 UTC (typical maintenance windows) where the Process Image Path contains keywords like \CrowdStrike\, \SentinelOne\, or \Symantec\. Additionally, exclude specific known benign file hashes associated with these vendors’ update modules.

• Automated Backup and Archiving Jobs

  • Scenario: Automated backup