ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis targets the presence of PureRAT, a remote access trojan used by adversaries to establish persistent control and exfiltrate data, by correlating known IOCs against network and endpoint telemetry. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised assets before the malware can be leveraged for lateral movement or further payload execution.

IOC Summary

Malware Family: PureRAT Total IOCs: 12 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`84[.]200[.]77[.]29:56001`	botnet_cc	2026-09-07	75%
ip:port	`45[.]192[.]211[.]116:56003`	botnet_cc	2026-09-07	75%
ip:port	`43[.]135[.]26[.]173:56002`	botnet_cc	2026-09-07	75%
ip:port	`37[.]120[.]222[.]88:56002`	botnet_cc	2026-09-07	75%
ip:port	`37[.]120[.]222[.]88:56001`	botnet_cc	2026-09-07	75%
ip:port	`31[.]57[.]38[.]195:56001`	botnet_cc	2026-09-07	75%
ip:port	`31[.]57[.]38[.]195:56002`	botnet_cc	2026-09-07	75%
ip:port	`31[.]57[.]38[.]195:56003`	botnet_cc	2026-09-07	75%
ip:port	`194[.]9[.]6[.]95:443`	botnet_cc	2026-09-07	75%
ip:port	`194[.]59[.]30[.]123:56003`	botnet_cc	2026-09-07	75%
ip:port	`160[.]179[.]230[.]137:443`	botnet_cc	2026-09-07	75%
ip:port	`107[.]149[.]8[.]58:443`	botnet_cc	2026-09-07	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["160.179.230.137", "107.149.8.58", "37.120.222.88", "84.200.77.29", "43.135.26.173", "45.192.211.116", "194.59.30.123", "31.57.38.195", "194.9.6.95"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["160.179.230.137", "107.149.8.58", "37.120.222.88", "84.200.77.29", "43.135.26.173", "45.192.211.116", "194.59.30.123", "31.57.38.195", "194.9.6.95"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Scenario: A DevOps engineer deploys a new internal monitoring agent or custom script that utilizes the specific hash or registry key associated with PureRAT for configuration storage.
- Filter/Exclusion: Exclude processes running from the specific deployment directory (e.g., C:\Program Files\InternalMonitoring\) or exclude the specific service name (e.g., InternalMonSvc) if the IOC is process-based.
Scenario: An IT administrator manually copies a backup of a known-good application binary to a temporary folder (C:\Temp\) for troubleshooting, and the binary’s hash matches one of the PureRAT IOCs due to a shared library or similar code structure.
- Filter/Exclusion: Exclude files located in standard temporary or backup directories (e.g., C:\Temp\, C:\Backups\) unless the file is executed directly from these locations, or add the specific parent process (e.g., explorer.exe or cmd.exe initiated by a known admin account) to the exclusion list.
Scenario: A scheduled task for a legacy line-of-business application updates its configuration file, which happens to reside in a path or have a name that matches a PureRAT IOC (e.g., a generic name like config.dat or a specific registry key used by multiple apps).
- Filter/Exclusion: Exclude the specific scheduled task name (e.g., LegacyApp_Update) or the specific process executing the update (e.g., LegacyAppUpdater.exe) from the detection logic.
Scenario: A security team runs a YARA scan or memory dump analysis using a tool that loads a PureRAT signature file into memory, causing the tool’s process or the loaded module to match the IOC.
- Filter/Exclusion: Exclude known security tooling processes (e.g., `y