ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of nine known indicators of compromise associated with PureRAT, a remote access trojan frequently used for initial access and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary establishes persistent control or exfiltrates sensitive data.

IOC Summary

Malware Family: PureRAT Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`84[.]32[.]41[.]19:56003`	botnet_cc	2026-09-21	75%
ip:port	`66[.]179[.]29[.]5:6000`	botnet_cc	2026-09-21	75%
ip:port	`46[.]151[.]182[.]67:56002`	botnet_cc	2026-09-21	75%
ip:port	`31[.]56[.]209[.]139:56001`	botnet_cc	2026-09-21	75%
ip:port	`31[.]56[.]209[.]139:56002`	botnet_cc	2026-09-21	75%
ip:port	`188[.]120[.]255[.]247:443`	botnet_cc	2026-09-21	75%
ip:port	`134[.]19[.]177[.]62:56001`	botnet_cc	2026-09-21	75%
ip:port	`134[.]19[.]177[.]62:56002`	botnet_cc	2026-09-21	75%
ip:port	`104[.]64[.]208[.]123:443`	botnet_cc	2026-09-21	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["134.19.177.62", "104.64.208.123", "84.32.41.19", "46.151.182.67", "31.56.209.139", "66.179.29.5", "188.120.255.247"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["134.19.177.62", "104.64.208.123", "84.32.41.19", "46.151.182.67", "31.56.209.139", "66.179.29.5", "188.120.255.247"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Scenario: A DevOps engineer or CI/CD pipeline (e.g., Jenkins, GitLab CI) executes a build script that downloads a specific version of a third-party Python library or dependency package from PyPI or npm. If the sha256 hash of the downloaded artifact matches one of the PureRAT IOCs (often due to a compromised upstream dependency or a shared hash collision with a legitimate open-source tool), the detection triggers.
- Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner.exe) or where the file path contains standard dependency directories like node_modules, site-packages, or .venv.
Scenario: An IT administrator performs a manual software deployment using a tool like SCCM (System Center Configuration Manager) or PDQ Deploy. The installer package for a legitimate application (e.g., a specific version of a Java JRE or a proprietary internal tool) contains a binary or DLL whose hash matches a PureRAT IOC, possibly because the vendor bundled a component that was previously flagged or due to a generic hash match.
- Filter/Exclusion: Exclude events where the parent process is a known deployment agent (e.g., ccmexec.exe, pdqdeploy.exe) or where the file path resides in standard installation directories such as C:\Program Files\ or C:\Program Files (x86)\ and the parent process has a valid digital signature from a known vendor.
Scenario: A security team or blue team member is actively testing PureRAT in an isolated lab environment or performing a tabletop exercise. They execute the PureRAT binary or its components directly from a shared network drive or a dedicated test folder to verify detection coverage.
- Filter/Exclusion: Exclude events where the file path contains keywords