ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing PureRAT to establish persistent remote access and exfiltrate sensitive data through initial vectors like phishing emails or exploit kits. Proactively hunting for these specific IOCs in Azure Sentinel is critical to rapidly identify early-stage compromises and disrupt the command and control channels before significant data loss occurs.

IOC Summary

Malware Family: PureRAT Total IOCs: 18 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	31[.]59[.]137[.]24:443	botnet_cc	2026-08-16	75%
ip:port	217[.]60[.]195[.]195:443	botnet_cc	2026-08-16	75%
ip:port	217[.]60[.]195[.]110:443	botnet_cc	2026-08-16	75%
ip:port	194[.]59[.]31[.]11:443	botnet_cc	2026-08-16	75%
ip:port	135[.]136[.]147[.]86:443	botnet_cc	2026-08-16	75%
ip:port	89[.]37[.]100[.]205:56003	botnet_cc	2026-08-15	75%
ip:port	31[.]59[.]137[.]24:56003	botnet_cc	2026-08-15	75%
ip:port	31[.]59[.]137[.]166:56001	botnet_cc	2026-08-15	75%
ip:port	217[.]60[.]195[.]40:443	botnet_cc	2026-08-15	75%
ip:port	217[.]60[.]195[.]40:56003	botnet_cc	2026-08-15	75%
ip:port	217[.]60[.]195[.]197:443	botnet_cc	2026-08-15	75%
ip:port	195[.]177[.]94[.]19:56001	botnet_cc	2026-08-15	75%
ip:port	195[.]177[.]94[.]19:56002	botnet_cc	2026-08-15	75%
ip:port	153[.]52[.]176[.]60:56003	botnet_cc	2026-08-15	75%
ip:port	153[.]52[.]176[.]60:56001	botnet_cc	2026-08-15	75%
ip:port	153[.]52[.]176[.]60:56002	botnet_cc	2026-08-15	75%
ip:port	124[.]198[.]131[.]110:56003	botnet_cc	2026-08-15	75%
ip:port	107[.]173[.]177[.]168:56003	botnet_cc	2026-08-15	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["217.60.195.110", "194.59.31.11", "31.59.137.24", "217.60.195.197", "135.136.147.86", "89.37.100.205", "31.59.137.166", "195.177.94.19", "153.52.176.60", "107.173.177.168", "217.60.195.40", "124.198.131.110", "217.60.195.195"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.195.110", "194.59.31.11", "31.59.137.24", "217.60.195.197", "135.136.147.86", "89.37.100.205", "31.59.137.166", "195.177.94.19", "153.52.176.60", "107.173.177.168", "217.60.195.40", "124.198.131.110", "217.60.195.195"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled

References

• ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Support Sessions via Managed Tools

  • Context: Enterprise Service Desks frequently use tools like BeyondTrust, TeamViewer, or Splashtop to connect to user endpoints. These tools utilize C2-like communication patterns and persistent background services that can mimic PureRAT’s network signatures, especially if the support agent connects from an IP range overlapping with known malicious infrastructure.
  • Filter/Exclusion: Create a whitelist exclusion for traffic originating from internal jump hosts or specific support subnets (e.g., 10.50.x.x). Additionally, filter alerts where the process name matches known legitimate RDP agents (BeyondTrustAgent.exe, TeamViewer_Service.exe) and the destination port is restricted to standard remote access ports (3389, 4932) rather than the dynamic ports often used by PureRAT.

• Scenario: Scheduled Backup and Exfiltration Jobs

  • Context: Automated backup solutions such as Veeam, Rubrik, or Microsoft Azure Backup run scheduled jobs that exfiltrate large volumes of data to cloud storage or on-premises repositories. The high-volume, periodic outbound traffic combined with the use of persistent services can trigger PureRAT’s “data exfiltration” logic, particularly if the backup destination IP is a shared public CDN node.
  • Filter/Exclusion: Implement a time-based exclusion for alerts occurring during defined maintenance windows (e.g., 02:00–04:00 local time). Filter out events where the initiating process is Veeam.Backup.Service.exe or AzureBackupAgent.exe and the destination IP belongs to known