ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the PureRAT remote access trojan by identifying matches against seven specific indicators of compromise within Azure Sentinel logs. A proactive search is essential to rapidly identify and isolate infected endpoints before attackers leverage PureRAT’s capabilities for long-term persistence, data exfiltration, and lateral movement across the enterprise network.

IOC Summary

Malware Family: PureRAT Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`91[.]92[.]47[.]214:6666`	botnet_cc	2026-09-02	75%
ip:port	`93[.]114[.]183[.]130:8711`	botnet_cc	2026-09-02	75%
ip:port	`56[.]69[.]248[.]141:443`	botnet_cc	2026-09-02	75%
ip:port	`56[.]69[.]232[.]66:443`	botnet_cc	2026-09-02	75%
ip:port	`45[.]139[.]104[.]204:443`	botnet_cc	2026-09-02	75%
ip:port	`45[.]139[.]104[.]204:55009`	botnet_cc	2026-09-02	75%
ip:port	`172[.]94[.]14[.]210:56013`	botnet_cc	2026-09-02	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["172.94.14.210", "56.69.232.66", "91.92.47.214", "93.114.183.130", "56.69.248.141", "45.139.104.204"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.94.14.210", "56.69.232.66", "91.92.47.214", "93.114.183.130", "56.69.248.141", "45.139.104.204"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Endpoint Protection Policy Deployment via Microsoft Intune
- Context: The IT Security team deploys a new group policy or configuration profile to Windows 10/11 endpoints using Microsoft Intune. This action triggers the creation of specific registry keys and file artifacts that match PureRAT’s IOCs (e.g., HKLM\Software\PureRAT or specific DLL paths in C:\ProgramData).
- Filter/Exclusion: Exclude alerts where the process name is msdtc.exe, IntuneManagementExtension.exe, or TaskHostW.exe and the parent process is Microsoft.Intune.Management.Extension. Additionally, filter out events occurring during known maintenance windows (e.g., 02:00–04:00 UTC) where bulk policy updates are scheduled.
Scenario: Automated Backup Job Execution by Veeam or Commvault
- Context: Enterprise backup agents (such as Veeam Agent for Microsoft Windows or Commvault Simpana) run scheduled jobs that scan and index specific directories. These agents often create temporary files, registry entries, or network connections to backup repositories that mimic the IOCs associated with PureRAT’s command-and-control (C2) communication patterns.
- Filter/Exclusion: Create a rule exclusion for processes named VeeamAgent.exe, vbr.exe, or CommServeAgent.exe. Furthermore, exclude network traffic originating from the backup subnet range (e.g., 10.x.x.0/24) destined for known internal backup repository IPs to prevent C2-like traffic triggers.
Scenario: Software Installation via SCCM (Configuration Manager)