This rule detects the presence of PureRAT, a remote access Trojan that facilitates encrypted command-and-control communications for data exfiltration and remote execution. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints before attackers leverage the RAT to establish persistent access and escalate privileges within the environment.
Malware Family: PureRAT Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 16[.]208[.]130[.]160:443 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 139[.]64[.]164[.]252:56001 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 139[.]64[.]164[.]252:56002 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 13[.]143[.]247[.]125:1996 | botnet_cc | 2026-09-23 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["139.64.164.252", "16.208.130.160", "13.143.247.125"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["139.64.164.252", "16.208.130.160", "13.143.247.125"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
curl or wget to download a specific build artifact or dependency from a ThreatFox-listed IP address (e.g., a public CDN or staging server) that happens to be flagged as a PureRAT C2 node due to shared infrastructure or a false positive in the IOC feed.
curl.exe, wget.exe, or powershell.exe (specifically when invoked by a service account) AND the destination port is 80/443, provided the IP is in a known “Whitelisted External Services” list.Task Scheduler or crontab) where the initiating process is svchost.exe or powershell.exe and the parent process is taskschd.msi or schtasks.exe, specifically if the destination IP is in the internal monitoring subnet (e.g., 10.20.0.0/24).nmap or masscan to scan external assets, and the scan hits a PureRAT C2 IP, triggering the detection rule due to the SYN/ACK traffic pattern.
nmap.exe, masscan.exe, or fping.exe AND the user context is a known “Security Team” AD group, provided the connection duration is less than 5 seconds (indicating a