ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the PureRAT remote access trojan by identifying specific indicators of compromise within network and endpoint telemetry. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify and contain stealthy lateral movement or data exfiltration attempts before they escalate into broader incidents.

IOC Summary

Malware Family: PureRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["23.111.14.80", "104.251.180.164"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["23.111.14.80", "104.251.180.164"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Tool Updates via Scheduled Tasks

  • Context: Enterprise Endpoint Detection and Response (EDR) agents or antivirus solutions often utilize scheduled tasks to fetch threat intelligence feeds. If the PureRAT IOCs include specific hash values or domain names that overlap with a known vendor’s update server, legitimate update jobs may trigger alerts.
  • Filter/Exclusion: Create an exclusion for processes spawned by trusted security vendors (e.g., CrowdStrike Falcon Sensor, SentinelOne Agent, Microsoft Defender Antivirus) when they connect to the flagged IOCs. Specifically, exclude traffic where the parent process is C:\Program Files\Microsoft Security Client\MsMpEng.exe or C:\ProgramData\CrowdStrike\FalconSensor\csfalcon.exe.

• Scenario: Admin Deployment of Internal Configuration Management Tools

  • Context: System administrators frequently use tools like Ansible, Puppet, or Microsoft SCCM (Configuration Manager) to push configurations. If PureRAT IOCs include generic IP ranges or domain suffixes used by the internal configuration management infrastructure, admin deployment jobs will generate false positives during maintenance windows.
  • Filter/Exclusion: Exclude alerts originating from specific Service Accounts used for automation (e.g., svc_ansible_deploy, SCCM_01) and restrict the rule to only trigger on non-admin user sessions or exclude traffic destined for internal IP ranges defined in the corporate asset inventory (e.g., 10.20.40.x).

• Scenario: Legitimate Remote Access via Third-Party Support Tools

  • Context: IT Helpdesk teams often utilize remote support tools like **