This hunt targets the presence of 29 known Indicators of Compromise associated with PureRAT, a remote access trojan frequently used by threat actors to establish persistent control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate infected hosts before the adversary can leverage the RAT for lateral movement, data exfiltration, or further payload deployment.
Malware Family: PureRAT Total IOCs: 29 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]92[.]243[.]114:56003 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 91[.]92[.]243[.]114:56001 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 91[.]92[.]243[.]114:56002 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 64[.]81[.]30[.]27:444 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]74[.]15[.]196:55012 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]192[.]214[.]55:56003 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]192[.]226[.]20:56001 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]192[.]226[.]20:56002 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]192[.]214[.]54:56001 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]192[.]214[.]54:56002 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]192[.]214[.]55:56001 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]192[.]214[.]55:56002 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]192[.]211[.]116:56001 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 45[.]192[.]211[.]116:56002 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 23[.]171[.]177[.]13:7222 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 217[.]60[.]195[.]139:56003 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 202[.]162[.]99[.]199:56001 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 194[.]59[.]30[.]123:56002 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 194[.]59[.]30[.]123:56001 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 186[.]240[.]202[.]85:56002 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 186[.]240[.]202[.]89:56002 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 186[.]240[.]202[.]89:56003 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 178[.]16[.]55[.]134:56001 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 160[.]179[.]226[.]78:443 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 147[.]124[.]214[.]219:56002 | botnet_cc | 2026-09-08 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["91.92.243.114", "194.59.30.123", "186.240.202.85", "186.240.202.89", "45.192.214.55", "45.192.211.116", "107.150.72.199", "202.162.99.199", "160.179.226.78", "217.60.195.139", "178.16.55.134", "104.239.66.26", "23.171.177.13", "45.192.226.20", "45.192.214.54", "45.74.15.196", "147.124.214.219", "64.81.30.27"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.243.114", "194.59.30.123", "186.240.202.85", "186.240.202.89", "45.192.214.55", "45.192.211.116", "107.150.72.199", "202.162.99.199", "160.179.226.78", "217.60.195.139", "178.16.55.134", "104.239.66.26", "23.171.177.13", "45.192.226.20", "45.192.214.54", "45.74.15.196", "147.124.214.219", "64.81.30.27"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Java Applet or Plugin Updates: PureRAT IOCs often include specific memory strings or file hashes associated with Java-based droppers. In environments running legacy web applications or desktop clients that rely on outdated Java Runtime Environments (JRE) or browser plugins, the update mechanism or the applet itself may match these IOCs.
java.exe or javaw.exe where the parent process is a known browser (chrome.exe, firefox.exe, msedge.exe) or a Java-based application server (e.g., tomcat, jboss), and limit the scope to user-mode processes rather than service-mode.Third-Party Remote Support Tools: Many enterprise support tools (such as TeamViewer, AnyDesk, or LogMeIn) use memory injection or specific API calls that can overlap with PureRAT’s behavioral IOCs, particularly regarding remote desktop control or screen capture functions. If the rule triggers on memory strings related to remote control, it may catch these legitimate tools.
teamviewer.exe, anydesk.exe, logmein.exe) and their associated helper services, unless the process is running from an unexpected directory like C:\Users\Public or C:\Temp.Software Development Kits (SDKs) and Testing Environments: Developers and QA engineers often run PureRAT samples or use testing frameworks that simulate RAT behavior to verify detection coverage. Additionally, certain C++ or .NET SDKs might include debug symbols or library names that match the file-based IOCs in the hunt package.
dev, qa, or test in your asset inventory, or exclude processes running from directories commonly associated with development environments (e.g., `C:\dev