This hunt detects adversary activity involving the PureRAT remote access trojan by identifying matches against a curated set of 45 Indicators of Compromise (IOCs). Proactive hunting for these specific IOCs within Azure Sentinel is critical to uncover early-stage infections and prevent potential lateral movement or data exfiltration before they escalate into significant incidents.
Malware Family: PureRAT Total IOCs: 45 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | draxwas.thruhere.net | botnet_cc | 2026-07-28 | 100% |
| domain | ge.ghostnod.h4ck.me | botnet_cc | 2026-07-28 | 100% |
| domain | richiescreen.com | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]192[.]211[.]7:56001 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]192[.]211[.]7:56003 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 80[.]76[.]49[.]3:56003 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]119[.]98[.]138:56001 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]119[.]98[.]138:56002 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]119[.]98[.]138:56003 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]119[.]98[.]140:56001 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]119[.]98[.]140:56002 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]119[.]98[.]140:56003 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]192[.]211[.]19:56001 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]192[.]211[.]19:56002 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]192[.]211[.]19:56003 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]192[.]211[.]63:56002 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 45[.]192[.]211[.]77:56002 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 151[.]242[.]63[.]153:56002 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 193[.]233[.]198[.]62:56002 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 193[.]26[.]115[.]104:56001 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 193[.]26[.]115[.]104:56002 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 193[.]26[.]115[.]104:56003 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 193[.]26[.]115[.]80:56001 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 193[.]26[.]115[.]80:56002 | botnet_cc | 2026-07-28 | 100% |
| ip:port | 193[.]26[.]115[.]80:56003 | botnet_cc | 2026-07-28 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["45.192.211.7", "108.187.4.145", "151.242.63.149", "45.192.211.77", "193.26.115.80", "216.107.139.88", "108.187.4.116", "112.121.176.5", "104.164.46.39", "193.26.115.104", "112.121.176.4", "45.119.98.111", "112.121.176.6", "45.192.211.19", "80.76.49.3", "151.242.63.153", "112.121.176.2", "193.233.198.62", "112.121.176.3", "45.119.98.138", "103.68.109.13", "45.192.211.63", "45.119.98.140"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.192.211.7", "108.187.4.145", "151.242.63.149", "45.192.211.77", "193.26.115.80", "216.107.139.88", "108.187.4.116", "112.121.176.5", "104.164.46.39", "193.26.115.104", "112.121.176.4", "45.119.98.111", "112.121.176.6", "45.192.211.19", "80.76.49.3", "151.242.63.153", "112.121.176.2", "193.233.198.62", "112.121.176.3", "45.119.98.138", "103.68.109.13", "45.192.211.63", "45.119.98.140"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - PureRAT
let malicious_domains = dynamic(["draxwas.thruhere.net", "ge.ghostnod.h4ck.me", "richiescreen.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: PureRAT IOCs detection rule in an enterprise environment:
Scenario: Legitimate deployment of a third-party Remote Access Tool (e.g., TeamViewer, AnyDesk, or Splashtop) where the installer or update service communicates with a known vendor IP that overlaps with a PureRAT C2 address.
TeamViewer.exe, AnyDeskService.exe) and their associated hash values, excluding them if the destination port is 443 or 80 and the source user is part of the “IT-Admins” group.Scenario: A scheduled maintenance job (e.g., a nightly Windows Update via SCCM or an automated backup script) executes a PowerShell command that queries a public threat intelligence API, triggering a network connection to an IOC IP used by PureRAT for reputation checks.
\Program Files\Microsoft Configuration Manager\ and the execution time falls within the defined maintenance window (e.g., 02:00–04:00 UTC), provided the user context is SYSTEM.Scenario: An internal Security Information and Event Management (SIEM) or EDR agent (such as CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a periodic telemetry upload to its cloud backend, where the backend’s IP range shares an ASN with one of the PureRAT IOCs.
FalconSensor.exe (or MsSense.exe) and filter out connections originating from the “Security-Operations” organizational unit, regardless of the destination IP match.Scenario: A developer or data analyst running a local