ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets network connections to known PureRAT command-and-control infrastructure, indicating potential remote access trojan activity that enables adversaries to maintain persistent control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the attacker can execute further post-exploitation actions or exfiltrate sensitive data.

IOC Summary

Malware Family: PureRAT Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`52[.]197[.]194[.]156:443`	botnet_cc	2026-09-28	75%
ip:port	`217[.]60[.]195[.]193:56101`	botnet_cc	2026-09-28	75%
ip:port	`15[.]152[.]249[.]154:443`	botnet_cc	2026-09-28	75%
ip:port	`148[.]66[.]5[.]59:4443`	botnet_cc	2026-09-28	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["52.197.194.156", "15.152.249.154", "217.60.195.193", "148.66.5.59"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["52.197.194.156", "15.152.249.154", "217.60.195.193", "148.66.5.59"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Scenario: A DevOps team deploys a custom internal build agent or CI/CD runner (e.g., Jenkins, GitLab Runner) that uses a shared library or binary named pure.exe or pure_agent.dll for task orchestration, which happens to match one of the PureRAT hash or filename IOCs.
- Filter/Exclusion: Exclude processes where the parent process is a known build tool (e.g., java.exe, node.exe, python.exe) and the process path resides in standard CI/CD directories (e.g., C:\Jenkins\workspace\, C:\GitLab\runner\).
Scenario: An IT administrator runs a legacy vendor-provided patching utility or hardware diagnostic tool (e.g., Dell Command Update, HP SoftPaq Downloader) that includes a helper binary with a generic name like pure_check.exe or a specific hash associated with the threat, executed from a temporary directory during a scheduled maintenance window.
- Filter/Exclusion: Exclude executions where the process path contains vendor-specific directories (e.g., C:\Program Files\Dell\, C:\HP\) and the parent process is a known service or scheduled task service (svchost.exe with a specific task name, or taskeng.exe).
Scenario: A security engineer or threat hunter manually executes a sample of the PureRAT binary in a sandboxed environment or on a dedicated jump box for analysis, using a tool like Process Monitor or Sysinternals, where the binary is copied to a local analysis folder (e.g., C:\Users\Analyst\Analysis\) and run from a command line.
- Filter/Exclusion: Exclude executions where the user account is a known service account for analysis (e.g., svc_threat_hunt, admin_sandbox) or