This hunt identifies network connections or host artifacts matching known indicators of compromise for PureRAT, a remote access trojan frequently deployed to establish persistent backdoors for lateral movement and data exfiltration. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect and isolate compromised endpoints before the adversary can leverage the RAT for command-and-control or further post-exploitation activities.
Malware Family: PureRAT Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 66[.]179[.]29[.]5:8080 | botnet_cc | 2026-09-24 | 75% |
| ip:port | 185[.]127[.]94[.]179:443 | botnet_cc | 2026-09-24 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["66.179.29.5", "185.127.94.179"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["66.179.29.5", "185.127.94.179"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legitimate Development or QA Testing of Remote Access Tools
C:\Dev\Tools directory or a shared network drive during integration testing.C:\Dev\, C:\QA\, or \\[Server]\Share\Tools\ and the user group is DevTeam or QAEngineers.Scheduled Maintenance Jobs for Legacy Application Patches
C:\Temp\ or %TEMP%) to apply patches. This executable might be signed by a vendor whose certificate or hash overlaps with known PureRAT IOCs due to similar build processes or shared libraries.svchost.exe or TaskScheduler and the file path contains \Temp\ or \AppData\Local\Temp\, provided the file is signed by a trusted internal CA or known vendor (e.g., AcmeCorp, LegacySoft).IT Admin Performing Manual Software Deployment via GPO or SCCM