This hypothesis targets the presence of known PureRAT indicators of compromise, which are frequently leveraged by adversaries to establish persistent remote access and execute command-and-control operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints early, mitigating the risk of data exfiltration or lateral movement before the malware can fully establish its foothold in the environment.
Malware Family: PureRAT Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 212[.]224[.]107[.]183:443 | botnet_cc | 2026-09-15 | 75% |
| ip:port | 144[.]91[.]78[.]57:4810 | botnet_cc | 2026-09-15 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["144.91.78.57", "212.224.107.183"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["144.91.78.57", "212.224.107.183"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
C:\Jenkins\workspace\ or C:\GitHub\actions-runner\) or those spawned by java.exe/node.exe in the parent process chain.powershell.exe or cmd.exe and the command line contains specific deployment flags (e.g., /install, /update, or -silent) or originates from a known network share path (e.g., \\fileserver\it\tools\).svc_redteam or sec_tester) or those located in a specific test directory (e.g., C:\Temp\RedTeam\ or D:\Assessment\).