ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the PureRAT remote access trojan by monitoring for specific indicators of compromise such as malicious IP addresses and file hashes within the Azure Sentinel environment. Proactively hunting for these IOCs is critical to identify early-stage infections that could lead to credential theft, lateral movement, or persistent unauthorized access before they escalate into a full-scale breach.

IOC Summary

Malware Family: PureRAT Total IOCs: 7 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["52.241.248.38", "45.9.12.6", "203.159.90.177", "176.96.138.2"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["52.241.248.38", "45.9.12.6", "203.159.90.177", "176.96.138.2"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - PureRAT
let malicious_domains = dynamic(["pure8s.ddnsfree.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding filters/exclusions for the ThreatFox: PureRAT IOCs detection rule in an enterprise environment:

• Scenario: Endpoint Protection Scanning of Quarantine Archives

  • Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) periodically scan archived or quarantined files containing historical malware signatures. If a legacy PureRAT sample exists in the quarantine vault, the EDR’s background scanning process may trigger the IOCs associated with that file hash.
  • Filter/Exclusion: Exclude processes matching C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe (or equivalent EDR service binaries) when they access files within the specific quarantine directory path (e.g., C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows Defender\Support\Quarantine).

• Scenario: Automated Security Baseline Updates via SCCM

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune pushes security definition updates and baseline configurations to workstations during maintenance windows. These packages often include signed scripts or binaries that match the PureRAT IOCs as part of a broader threat intelligence feed update mechanism.
  • Filter/Exclusion: Filter out events where the parent process is ccmexec.exe (SCCM) or Microsoft.IntuneManagementExtension.exe and the user context is NT SERVICE\CCMService.

• Scenario: Scheduled Malware Definition Refresh Jobs

  • Context: A scheduled Windows Task (Task Scheduler) runs nightly to download and apply new threat intelligence definitions from a central repository. If the PureRAT IOCs are part of the vendor’s definition package, the scheduled task execution will generate hits against these specific hashes or network connections.
  • **Filter/