ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the PureRAT remote access trojan, which is frequently used for credential theft and lateral movement within enterprise networks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage infections before they escalate into broader data exfiltration or persistent backdoor access incidents.

IOC Summary

Malware Family: PureRAT Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`89[.]213[.]118[.]63:56002`	botnet_cc	2026-07-31	75%
ip:port	`82[.]22[.]204[.]150:56001`	botnet_cc	2026-07-31	75%
ip:port	`27[.]124[.]36[.]153:443`	botnet_cc	2026-07-31	75%
ip:port	`207[.]174[.]0[.]103:56002`	botnet_cc	2026-07-31	75%
ip:port	`194[.]59[.]30[.]183:443`	botnet_cc	2026-07-31	75%
ip:port	`181[.]215[.]242[.]84:56001`	botnet_cc	2026-07-31	75%
ip:port	`13[.]205[.]246[.]212:443`	botnet_cc	2026-07-31	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["207.174.0.103", "194.59.30.183", "13.205.246.212", "89.213.118.63", "82.22.204.150", "181.215.242.84", "27.124.36.153"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["207.174.0.103", "194.59.30.183", "13.205.246.212", "89.213.118.63", "82.22.204.150", "181.215.242.84", "27.124.36.153"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Enterprise Endpoint Protection Scans
- Context: The detection logic identifies a specific hash or file path associated with PureRAT. In many environments, the primary endpoint protection suite (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) performs scheduled deep scans that generate temporary process trees matching the PureRAT IOCs during their update cycles or heuristic analysis phases.
- Filter/Exclusion: Create a rule exclusion based on the Parent Process Name. Exclude alerts where the parent process is MsMpEng.exe (Defender), FalconSensorService.exe (CrowdStrike), or SentinelOne.exe. Additionally, exclude file paths located within the vendor’s installation directory (e.g., C:\Program Files\Microsoft Defender Antivirus\).
Scenario: Automated Patch Management & Deployment Jobs
- Context: IT administrators often use tools like SCCM (System Center Configuration Manager), Ivanti, or Ansible to deploy software updates. These tools frequently download and stage installer packages in temporary directories that may contain files with hashes matching the PureRAT IOCs before the actual installation begins. The detection rule triggers on these staging activities rather than malicious execution.
- Filter/Exclusion: Implement a filter based on User Context and Scheduled Task Names. Exclude alerts generated by service accounts such as NT SERVICE\SCCM or SYSTEM where the process is spawned by a known scheduled task (e.g., “Software Update Deployment” or “Patch Cycle”). You can also exclude file paths under standard deployment directories like C:\Windows\CCM\Cache\.
**Scenario: Internal Development & CI/CD Pipeline Artifacts