ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets known indicators of compromise for PureRAT, a remote access trojan frequently used by threat actors to establish persistent control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the adversary can leverage the RAT for lateral movement or data exfiltration.

IOC Summary

Malware Family: PureRAT Total IOCs: 7 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`64[.]89[.]161[.]92:56001`	botnet_cc	2026-09-26	75%
ip:port	`31[.]56[.]209[.]161:56003`	botnet_cc	2026-09-26	75%
ip:port	`217[.]60[.]77[.]60:56004`	botnet_cc	2026-09-26	75%
ip:port	`195[.]177[.]94[.]227:56002`	botnet_cc	2026-09-26	75%
ip:port	`185[.]94[.]29[.]158:56003`	botnet_cc	2026-09-26	75%
ip:port	`185[.]254[.]99[.]169:56001`	botnet_cc	2026-09-26	75%
ip:port	`154[.]18[.]239[.]166:56003`	botnet_cc	2026-09-26	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["31.56.209.161", "217.60.77.60", "64.89.161.92", "185.94.29.158", "195.177.94.227", "154.18.239.166", "185.254.99.169"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.56.209.161", "217.60.77.60", "64.89.161.92", "185.94.29.158", "195.177.94.227", "154.18.239.166", "185.254.99.169"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Scenario: A security team performs a manual threat hunt using Sysmon or WMI to query for specific file hashes or registry keys associated with known PureRAT variants during a quarterly audit.
- Filter/Exclusion: Exclude events where the initiating process is wmic.exe, powershell.exe, or sysmon.exe and the parent process is a known security tool (e.g., splunk.exe, crowdstrikeagent.exe, or defender.exe).
Scenario: An IT administrator deploys a legacy internal application or driver that shares a common hash or file path with one of the PureRAT IOCs due to poor versioning or reuse of open-source components.
- Filter/Exclusion: Exclude file paths under specific trusted directories such as C:\Program Files\InternalApps\ or C:\Windows\System32\drivers\ if the file age is greater than 90 days and the digital signature is valid.
Scenario: A scheduled backup job or data migration task copies a known PureRAT sample file (used for testing or reference) into a network share or backup repository, triggering the IOC match.
- Filter/Exclusion: Exclude events where the destination path contains keywords like \Backup\, \Archive\, or \TestSamples\ and the source process is a backup utility (e.g., vssadmin.exe, wbadmin.exe, or rsync).
Scenario: A developer or QA engineer runs a PureRAT sample in an isolated lab environment or a dedicated test VM that has network connectivity to the production segment, causing the IOC to be detected on a non-production host.
- Filter/Exclusion: Exclude hosts tagged with AD groups or tags such as Lab-VMs, Dev-Test, or `QA-Environment