This hunt targets adversary behavior where attackers deploy the PureRAT remote access trojan to establish persistent command-and-control channels and exfiltrate sensitive data via its known infrastructure indicators. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of PureRAT activity allows the SOC team to isolate compromised endpoints before lateral movement occurs, mitigating the high risk associated with this sophisticated RAT’s data theft capabilities.
Malware Family: PureRAT Total IOCs: 15 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 94[.]26[.]83[.]138:56003 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 94[.]26[.]83[.]138:56001 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 94[.]26[.]83[.]138:56002 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 209[.]99[.]186[.]11:56001 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 209[.]99[.]186[.]11:56003 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 162[.]251[.]120[.]10:56003 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 135[.]136[.]144[.]95:56001 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 135[.]136[.]144[.]95:56002 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 135[.]136[.]144[.]95:56003 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 38[.]92[.]47[.]237:56001 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 38[.]92[.]47[.]237:56002 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 38[.]92[.]47[.]237:56003 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 162[.]251[.]120[.]10:56001 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 162[.]251[.]120[.]10:56002 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 198[.]37[.]105[.]33:56001 | botnet_cc | 2026-07-21 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["135.136.144.95", "198.37.105.33", "209.99.186.11", "38.92.47.237", "94.26.83.138", "162.251.120.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["135.136.144.95", "198.37.105.33", "209.99.186.11", "38.92.47.237", "94.26.83.138", "162.251.120.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Endpoint Protection Scanning of Quarantine Archives
NT AUTHORITY\SYSTEM, svc-crowdstrike) accessing specific quarantine directories (e.g., C:\ProgramData\Microsoft Defender Antivirus\Quarantine).Software Deployment via Configuration Management Tools
ccmexec.exe, ansible-runner) combined with a time-based filter to only apply the rule outside of standard maintenance windows (e.g., 02:00–06:00 UTC).Automated Vulnerability Scanning and Asset Discovery