This hunt identifies network connections to known PureRAT command-and-control infrastructure, indicating potential remote access trojan deployment for persistent system control. Proactively hunting these IOCs in Azure Sentinel allows the SOC to detect and isolate compromised endpoints before the adversary establishes a stable foothold or executes lateral movement.
Malware Family: PureRAT Total IOCs: 8 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 84[.]200[.]91[.]170:443 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 5[.]175[.]169[.]148:443 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 217[.]60[.]195[.]60:443 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 217[.]60[.]195[.]60:56001 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 217[.]60[.]195[.]60:56002 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 217[.]60[.]195[.]60:56003 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 13[.]143[.]247[.]204:4810 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 104[.]168[.]148[.]29:443 | botnet_cc | 2026-09-22 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["217.60.195.60", "104.168.148.29", "13.143.247.204", "84.200.91.170", "5.175.169.148"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.195.60", "104.168.148.29", "13.143.247.204", "84.200.91.170", "5.175.169.148"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
java.exe or JRE binaries. In environments running legacy enterprise applications (e.g., older versions of SAP, Oracle EBS, or custom internal tools) that bundle specific JRE versions, the hash of the java.exe binary may match the IOC.
javaw.exe, java.exe from C:\Program Files\Java\) and the file path resides in standard application directories (e.g., C:\Program Files\, C:\Program Files (x86)\).msvcp140.dll or a specific version of vcredist installer, it may trigger on standard Windows Update installations or software deployment via SCCM/Intune.
C:\Windows\Temp\, C:\Windows\Installer\, or is spawned by TrustedInstaller.exe, WindowsUpdate.exe, or ccmexec.exe (SCCM).msbuild.exe, dotnet.exe, or npm cache binaries). In development or DevOps environments, these binaries are frequently downloaded, cached, or executed during build processes.
cmd.exe or powershell.exe in a user profile directory (e.g