This hypothesis targets the presence of PureRAT, a remote access trojan that enables adversaries to establish persistent control and execute arbitrary commands on compromised endpoints. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify and isolate infected systems before the malware can be leveraged for lateral movement or data exfiltration.
Malware Family: PureRAT Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 66[.]94[.]113[.]10:443 | botnet_cc | 2026-09-12 | 75% |
| ip:port | 107[.]172[.]232[.]71:443 | botnet_cc | 2026-09-12 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["107.172.232.71", "66.94.113.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["107.172.232.71", "66.94.113.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses curl or wget to download a specific PureRAT payload hash (e.g., sha256:abc123...) from a public GitHub repository or internal artifact registry for testing a new build pipeline. The file is downloaded to a temporary directory (/tmp or C:\Temp) and executed by a CI/CD agent or manual test script.
jenkins.exe, gitlab-runner, actions-runner) or where the file path matches a designated test/staging directory (e.g., *\\test\\*, */tmp/*, */staging/*).Scenario: An IT administrator runs a scheduled PowerShell script to verify the integrity of backup files. The script uses Get-FileHash to compute the SHA256 of a backup archive that happens to match one of the PureRAT IOCs (a rare but possible collision or intentional test file). The script runs from a standard admin account on a management server.
powershell.exe or pwsh.exe and the command line contains hash verification keywords (e.g., Get-FileHash, certutil -hashfile, sha256sum) or if the user account belongs to a service group like BackupAdmins or CI_ServiceAccounts.Scenario: A security team conducts a red team exercise or a controlled malware simulation (e.g., using a tool like Metasploit or a custom PoC) on a non-production test VM. The PureRAT binary is dropped and executed to test EDR detection capabilities. The host is tagged as a “Test” or “Lab” machine in