This hunt detects adversary activity involving the PureRAT remote access trojan by identifying matches against seven specific indicators of compromise within Azure Sentinel logs. Proactive hunting is essential to rapidly identify and contain this sophisticated threat before it establishes persistence or exfiltrates sensitive data from the environment.
Malware Family: PureRAT Total IOCs: 7 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 95[.]133[.]229[.]173:56001 | botnet_cc | 2026-08-08 | 75% |
| ip:port | 45[.]56[.]165[.]197:443 | botnet_cc | 2026-08-08 | 75% |
| ip:port | 45[.]56[.]165[.]197:56001 | botnet_cc | 2026-08-08 | 75% |
| ip:port | 209[.]99[.]190[.]23:55011 | botnet_cc | 2026-08-08 | 75% |
| ip:port | 2[.]59[.]133[.]115:443 | botnet_cc | 2026-08-08 | 75% |
| ip:port | 172[.]252[.]172[.]32:443 | botnet_cc | 2026-08-08 | 75% |
| ip:port | 129[.]146[.]57[.]192:56001 | botnet_cc | 2026-08-08 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["2.59.133.115", "209.99.190.23", "95.133.229.173", "129.146.57.192", "45.56.165.197", "172.252.172.32"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["2.59.133.115", "209.99.190.23", "95.133.229.173", "129.146.57.192", "45.56.165.197", "172.252.172.32"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:
Scenario: Security Operations Center (SOC) analysts manually running threat intelligence feeds or performing YARA scans using tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Wazuh. These agents often download the PureRAT IOC hash list to update their local detection libraries, triggering a match on the file creation or network connection event.
Process Name is falcon-sensor.exe, MsMpEng.exe, or wazuh-agentd.exe AND the User Account belongs to the Security_Admin group.Scenario: Automated vulnerability scanning jobs (e.g., Tenable Nessus, Qualys, or OpenVAS) running scheduled nightly scans that download and cache IOC definitions from ThreatFox repositories. The scanner service account often initiates network connections to fetch these specific PureRAT signatures, mimicking the behavior of a compromised host pulling down malware indicators.
Scheduled Tasks named “Tenable Agent Update” or “Qualys Cloud Connector Sync” running under the local system account (NT AUTHORITY\SYSTEM) between 01:00 and 05:00 UTC.Scenario: Enterprise Endpoint Detection and Response (EDR) systems performing a “Threat Intelligence Feed Synchronization.” For instance, SentinelOne or Carbon Black agents periodically pull the latest PureRAT IOC package from the management server to ensure local detection rules are up-to-date before the business day begins.
Source IP is within the internal EDR Management Server subnet (e.g.,