This hunt identifies hosts exhibiting indicators of compromise associated with the PureRAT remote access trojan, a tool frequently used by adversaries to establish persistent backdoor access and execute remote commands. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect early-stage infections and lateral movement attempts before the malware can fully establish control or exfiltrate sensitive data.
Malware Family: PureRAT Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]192[.]214[.]54:56003 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 137[.]220[.]194[.]12:56003 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 118[.]107[.]1[.]203:56003 | botnet_cc | 2026-09-14 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["118.107.1.203", "45.192.214.54", "137.220.194.12"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["118.107.1.203", "45.192.214.54", "137.220.194.12"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a custom PowerShell script to deploy a lightweight monitoring agent (e.g., a modified version of Sysinternals or a custom C# binary) that mimics PureRAT’s process injection or memory allocation patterns for performance benchmarking.
powershell.exe or pwsh.exe and the executable path resides in a known deployment directory (e.g., C:\Scripts\Deploy\ or C:\Tools\Monitoring\), provided the binary is signed by the internal CA.Scenario: An IT administrator runs a scheduled task using Task Scheduler to execute a third-party remote support tool (e.g., TeamViewer, AnyDesk, or RustDesk) that uses similar IPC mechanisms or named pipes as PureRAT for screen sharing and command execution.
teamviewer.exe, anydesk.exe, rustdesk.exe) and the parent process is svchost.exe (indicating it was launched by a service) or explorer.exe (indicating user-initiated launch), and the process integrity level is “Medium” or “High”.Scenario: A security team performs a purple team exercise using a legitimate open-source RAT (e.g., Nanoray or Metasploit’s meterpreter) for testing, which shares behavioral IOCs (such as specific registry keys or mutex names) with PureRAT.
purple, test, exercise, or drill, or where the process is launched by a known test harness (e.g., strelka.exe, `crowdstrike-falcon