ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis targets the presence of known PureRAT indicators of compromise, which are frequently used by threat actors to establish persistent remote access and execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the adversary can leverage the RAT for lateral movement or data exfiltration.

IOC Summary

Malware Family: PureRAT Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`84[.]21[.]189[.]110:56003`	botnet_cc	2026-09-25	75%
ip:port	`38[.]240[.]49[.]89:56001`	botnet_cc	2026-09-25	75%
ip:port	`31[.]56[.]209[.]161:56001`	botnet_cc	2026-09-25	75%
ip:port	`31[.]56[.]209[.]161:56002`	botnet_cc	2026-09-25	75%
ip:port	`31[.]56[.]209[.]161:443`	botnet_cc	2026-09-25	75%
ip:port	`212[.]86[.]125[.]129:56001`	botnet_cc	2026-09-25	75%
ip:port	`212[.]86[.]125[.]129:56002`	botnet_cc	2026-09-25	75%
ip:port	`156[.]236[.]76[.]31:443`	botnet_cc	2026-09-25	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["38.240.49.89", "156.236.76.31", "212.86.125.129", "31.56.209.161", "84.21.189.110"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.240.49.89", "156.236.76.31", "212.86.125.129", "31.56.209.161", "84.21.189.110"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Scenario: A DevOps engineer runs a custom PowerShell script to audit outbound network connections, which iterates through a hardcoded list of known threat IP addresses (including PureRAT C2 nodes) to verify if any internal hosts are connecting to them.
- Filter/Exclusion: Exclude events where the source process is powershell.exe or pwsh.exe and the command line contains keywords like Test-NetConnection, Resolve-DnsName, or specific audit script names (e.g., net-audit.ps1).
Scenario: An IT administrator uses a network monitoring tool like Wireshark or PRTG to capture and analyze traffic, where the tool’s internal configuration or database references PureRAT IOCs for baseline comparison or alert correlation.
- Filter/Exclusion: Exclude events where the source process is a known network monitoring application (e.g., wireshark.exe, prtg.exe, zabbix_agent2.exe) or where the user account belongs to a service group like NETMON-SVC.
Scenario: A security team deploys a YARA rule or Sigma rule set that includes PureRAT IOCs for memory scanning or log correlation; the scanning engine (e.g., Velociraptor, Wazuh, or CrowdStrike Falcon) reads these IOCs from a configuration file or database, triggering file access or registry read events.
- Filter/Exclusion: Exclude events where the source process is a security agent (e.g., csagent.exe, wazuh-agent.exe, velociraptor.exe) and the object path contains /rules/, /sigma/, or /yara/ directories.
Scenario: A CI/CD pipeline runs a security gate that downloads a threat intelligence feed (e.g., from MISP or OTX) containing PureRAT IOCs