This hunt targets known indicators of compromise associated with the Pulsar RAT, a remote access trojan frequently used by threat actors to establish persistent footholds and execute command-and-control operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised endpoints before the adversary can leverage the RAT for lateral movement or data exfiltration.
Malware Family: Pulsar RAT Total IOCs: 9 IOC Types: sha256_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 5f109e7bb3df4dea81946f2f853da288 | payload | 2026-09-16 | 50% |
| md5_hash | 87b76a60ba7c474dbf8f689df2808e1a | payload | 2026-09-16 | 50% |
| md5_hash | f9e95a1e1fa3f3aebfc802c6c8e6a2eb | payload | 2026-09-16 | 50% |
| sha256_hash | 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 | payload | 2026-09-16 | 50% |
| sha256_hash | 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c | payload | 2026-09-16 | 50% |
| sha256_hash | 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca | payload | 2026-09-16 | 50% |
| sha256_hash | 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 | payload | 2026-09-16 | 50% |
| sha256_hash | ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f | payload | 2026-09-16 | 50% |
| sha256_hash | c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 | payload | 2026-09-16 | 50% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Pulsar RAT
let malicious_hashes = dynamic(["5f109e7bb3df4dea81946f2f853da288", "87b76a60ba7c474dbf8f689df2808e1a", "f9e95a1e1fa3f3aebfc802c6c8e6a2eb", "106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42", "170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c", "223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca", "5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552", "ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f", "c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer deploys a custom monitoring agent or a specific version of a third-party RMM (Remote Monitoring and Management) tool (e.g., ConnectWise, Datto, or a bespoke Python-based script) that uses the same hash or file path as one of the Pulsar RAT IOCs for its local service binary.
C:\Program Files\ConnectWise\, C:\Program Files (x86)\Datto\) or where the parent process is a known service manager (e.g., svchost.exe with a specific service name) rather than a user-interactive shell.Scenario: An IT administrator performs a manual cleanup of temporary files or old log archives using a script that generates a temporary executable or data file matching the SHA-256 or MD5 hash of a Pulsar RAT component, often stored in C:\Users\<Admin>\AppData\Local\Temp or C:\Windows\Temp.
\Temp\ or \AppData\Local\Temp\ and the file age is less than 24 hours, or where the creating process is a known administrative tool (e.g., powershell.exe, cmd.exe, or 7z.exe) initiated by an account in the Domain Admins or IT_Ops group.Scenario: A software vendor updates a legacy application (e.g., a specific version of a PDF editor, database client, or legacy Java applet) that bundles a helper library or installer component with a hash identical to one of the Pulsar RAT IOCs due to shared code or outdated build artifacts.