PureRAT is a remote access trojan that grants adversaries persistent control over compromised hosts to facilitate data exfiltration and lateral movement. Proactively hunting for its known indicators of compromise in Azure Sentinel allows the SOC team to identify infected endpoints before attackers can establish a foothold and extract sensitive data.
Malware Family: PureRAT Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 5[.]56[.]25[.]180:443 | botnet_cc | 2026-09-16 | 75% |
| ip:port | 144[.]91[.]78[.]57:443 | botnet_cc | 2026-09-16 | 75% |
| ip:port | 139[.]180[.]153[.]29:443 | botnet_cc | 2026-09-16 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["139.180.153.29", "5.56.25.180", "144.91.78.57"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["139.180.153.29", "5.56.25.180", "144.91.78.57"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a legitimate remote administration tool (e.g., AnyDesk or TeamViewer) that shares similar network beaconing intervals or process injection techniques with PureRAT, particularly when connecting to a Linux server from a Windows workstation.
anydesk.exe, teamviewer.exe, nagiosagent.exe) AND the destination IP is within the corporate RMM subnet range (e.g., 10.20.0.0/24).Scenario: A scheduled backup job using Veeam Agent or Acronis True Image initiates a high-volume data transfer over a non-standard port (e.g., 443 or 8080) to an internal backup storage server, mimicking the data exfiltration pattern of PureRAT.
veeamagent.exe, acronis.exe) AND the destination hostname resolves to an internal DNS suffix (e.g., *.corp.local or *.backup.internal).Scenario: A software deployment tool like Ansible or Chef pushes configuration updates to remote nodes, creating short-lived outbound connections to the master server that may be flagged as suspicious beaconing if the master IP is not whitelisted in the threat feed.
ansible-playbook.exe or chef-client.exe AND the destination IP matches the known IP range of the Configuration Management Database (CMDB) or Ansible Tower server.Scenario: A developer runs a local testing framework (e.g., Postman or Insomnia)