ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known PureRAT indicators of compromise, which are frequently leveraged by adversaries for remote access and command-and-control operations. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, as PureRAT is a high-severity threat that can enable persistent access and lateral movement within the environment.

IOC Summary

Malware Family: PureRAT Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]88[.]91[.]165:7590`	botnet_cc	2026-09-20	75%
ip:port	`45[.]139[.]104[.]26:55012`	botnet_cc	2026-09-20	75%
ip:port	`94[.]154[.]32[.]189:56002`	botnet_cc	2026-09-19	75%
ip:port	`94[.]154[.]32[.]189:443`	botnet_cc	2026-09-19	75%
ip:port	`94[.]154[.]32[.]189:56001`	botnet_cc	2026-09-19	75%
ip:port	`89[.]106[.]83[.]225:56001`	botnet_cc	2026-09-19	75%
ip:port	`89[.]106[.]83[.]225:56002`	botnet_cc	2026-09-19	75%
ip:port	`89[.]106[.]83[.]225:56003`	botnet_cc	2026-09-19	75%
ip:port	`64[.]89[.]161[.]92:56002`	botnet_cc	2026-09-19	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["64.89.161.92", "94.154.32.189", "45.88.91.165", "45.139.104.26", "89.106.83.225"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.89.161.92", "94.154.32.189", "45.88.91.165", "45.139.104.26", "89.106.83.225"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Scenario: A DevOps team uses a custom PowerShell script to deploy a lightweight remote management agent (e.g., a modified version of PsExec or a custom .NET binary) that shares the same memory footprint or file hash as one of the PureRAT IOCs.
- Filter/Exclusion: Exclude alerts where the process path is located in C:\Program Files\CorpTools\ or C:\Scripts\Deploy\, and the parent process is powershell.exe or pwsh.exe initiated by a known service account.
Scenario: An IT administrator runs a scheduled task to clean up temporary files and deletes a known PureRAT IOC file (e.g., svchost.exe or a specific DLL) from a user’s %TEMP% directory, triggering a file deletion or hash match alert.
- Filter/Exclusion: Exclude alerts where the action is “Delete” or “Rename” and the file path contains %TEMP%, AppData\Local\Temp, or C:\Windows\Temp, and the user belongs to the IT_Admins or Service_Accounts AD group.
Scenario: A security team performs a red team exercise or internal penetration test, deploying a PureRAT sample to a non-production test environment to validate detection coverage, which generates expected IOC hits.
- Filter/Exclusion: Exclude alerts where the source computer name matches the pattern TEST- or LAB- (e.g., TEST-WIN10-01), or where the user account belongs to the RedTeam_Testers group.
Scenario: A legacy application or vendor-provided tool (e.g., a specific version of a remote support tool like TeamViewer or AnyDesk) bundles a component that shares a file hash or memory signature with one of the PureRAT