ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of PureRAT remote access trojans by detecting specific indicators of compromise known to establish persistent command-and-control channels. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised endpoints before attackers can exfiltrate sensitive data or execute lateral movement across the cloud environment.

IOC Summary

Malware Family: PureRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["51.79.170.115", "209.99.191.60"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["51.79.170.115", "209.99.191.60"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: PureRAT IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

• Endpoint Management Agent Updates via Scheduled Tasks

  • Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Trend Micro Apex One often utilize scheduled tasks to download and install security definitions or agent updates. These processes may establish outbound connections to vendor update servers that share IP addresses or domain names with the PureRAT IOCs, particularly if the threat intelligence feed flags a shared hosting provider (e.g., AWS or Azure) used by both the RAT and legitimate vendors.
  • Filter/Exclusion: Create an exclusion for process paths containing known EDR agent binaries (e.g., C:\Program Files\Microsoft Defender Antivirus\MsMpEng.exe or C:\ProgramData\CrowdStrike\fsagent.exe) when communicating with the specific IOCs. Additionally, filter out traffic originating from scheduled tasks named “Defender Update” or similar vendor-specific maintenance jobs.

• IT Administration Remote Management Sessions

  • Scenario: System Administrators frequently use remote management tools such as Microsoft SCCM (Configuration Manager), Ivanti, or TeamViewer to deploy patches, run scripts, or troubleshoot workstations. During these sessions, the management server may initiate connections to external repositories or cloud-based asset inventory services that resolve to IP addresses overlapping with PureRAT indicators. This is common when admins are pushing a “Pure” software suite update or managing a third-party remote access tool.
  • Filter/Exclusion: Exclude traffic generated by known administrative service accounts (e.g., DOMAIN\svc-sccm, DOMAIN\admin-remote) and specific process names like ccmexec.exe (SCCM) or