ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the PureRAT remote access trojan by monitoring network and endpoint telemetry against seven specific indicators of compromise known to facilitate persistent command-and-control communication and credential theft. Proactive hunting for these IOCs within Azure Sentinel is critical because PureRAT’s ability to establish long-term footholds allows attackers to exfiltrate sensitive data undetected, necessitating early identification before lateral movement occurs.

IOC Summary

Malware Family: PureRAT Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`192[.]229[.]115[.]156:56001`	botnet_cc	2026-08-11	75%
ip:port	`192[.]229[.]115[.]156:56002`	botnet_cc	2026-08-11	75%
ip:port	`192[.]229[.]115[.]156:56003`	botnet_cc	2026-08-11	75%
ip:port	`192[.]229[.]115[.]162:56001`	botnet_cc	2026-08-11	75%
ip:port	`192[.]229[.]115[.]154:56001`	botnet_cc	2026-08-11	75%
ip:port	`192[.]229[.]115[.]154:56003`	botnet_cc	2026-08-11	75%
ip:port	`185[.]174[.]101[.]235:443`	botnet_cc	2026-08-11	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["192.229.115.156", "192.229.115.154", "192.229.115.162", "185.174.101.235"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.229.115.156", "192.229.115.154", "192.229.115.162", "185.174.101.235"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Security Tool Health Checks
- Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently perform internal health checks that involve querying threat intelligence platforms. If the PureRAT IOCs include specific DNS lookups or HTTP GET requests to known threat feeds, these tools may trigger the rule during their routine synchronization cycles.
- Filter/Exclusion: Exclude traffic originating from the specific service accounts used by the EDR agents (e.g., CROWDSTRIE-SVC or MDE-AGENT) and filter out network connections where the destination IP belongs to the vendor’s official update servers (e.g., *.crowdstrike.com, *.microsoft.com).
Scenario: Scheduled Admin Backup Jobs
- Context: Enterprise backup solutions such as Veeam Backup & Replication or Rubrik often run scheduled jobs that scan external repositories. If PureRAT IOCs include specific file hashes or registry keys related to data integrity verification, these backup agents might generate alerts when they access shared network drives or cloud storage endpoints matching the IOC criteria.
- Filter/Exclusion: Create an exclusion rule for processes running under the context of backup service accounts (e.g., SYSTEM or specific domain accounts like DOMAIN\BackupSvc) executing during defined maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Software Deployment via SCCM/Intune
- Context: During mass software deployments using Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune, the deployment engine may download