This hunt detects adversary activity involving the PureRAT remote access trojan by monitoring for specific indicators of compromise such as malicious hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical to identify early-stage infections that could lead to credential theft and lateral movement within the enterprise environment.
Malware Family: PureRAT Total IOCs: 7 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]124[.]98[.]42:443 | botnet_cc | 2026-08-02 | 75% |
| ip:port | 38[.]247[.]147[.]37:56002 | botnet_cc | 2026-08-02 | 75% |
| ip:port | 38[.]247[.]147[.]37:56003 | botnet_cc | 2026-08-02 | 75% |
| ip:port | 38[.]247[.]147[.]37:56001 | botnet_cc | 2026-08-02 | 75% |
| ip:port | 31[.]57[.]147[.]182:56001 | botnet_cc | 2026-08-02 | 75% |
| ip:port | 31[.]57[.]147[.]182:56002 | botnet_cc | 2026-08-02 | 75% |
| ip:port | 194[.]59[.]30[.]183:56001 | botnet_cc | 2026-08-02 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["38.247.147.37", "91.124.98.42", "194.59.30.183", "31.57.147.182"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.247.147.37", "91.124.98.42", "194.59.30.183", "31.57.147.182"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, tailored for a legitimate enterprise environment:
Endpoint Protection Scanning of Quarantined Archives
falcon.sys (CrowdStrike) or MsMpEng.exe (Defender) and the action type is “Scan” or “Quarantine,” provided the file age exceeds 30 days.Scheduled Software Deployment via Configuration Management
C:\Program Files\SharedLibs directory. The deployment package includes a specific DLL component that matches one of the PureRAT IOCs, triggering an alert during the installation phase.C:\Program Files\SharedLibs\* and exclude alerts generated by process names ccmsetup.exe, msiexec.exe, or ansible-runner when running under the context of the “System” account during business hours (08:00–18:00).Third-Party Backup Agent Execution