ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the PureRAT Remote Access Trojan to establish persistent command execution channels and facilitate sensitive data exfiltration within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical due to the high severity of PureRAT’s capability to silently compromise endpoints and extract confidential information before detection occurs.

IOC Summary

Malware Family: PureRAT Total IOCs: 13 IOC Types: ip:port, sha256_hash, sha1_hash, md5_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["179.61.227.213", "136.0.213.135", "154.201.82.108", "84.201.20.74", "183.90.187.111", "195.177.94.91", "183.90.187.73", "154.201.82.105", "183.90.187.2"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["179.61.227.213", "136.0.213.135", "154.201.82.108", "84.201.20.74", "183.90.187.111", "195.177.94.91", "183.90.187.73", "154.201.82.105", "183.90.187.2"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - PureRAT
let malicious_hashes = dynamic(["5bfdc93f36ecf75b5be5590a48bdc58503c34fb0", "2ca17777470b32e4e74b547e5f3f9306", "f63eb2664ac9076250491b1cb0787042f75a056e235867d9f9967322c5cf20a4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Support Sessions via Enterprise Tools

  • Context: Helpdesk administrators frequently use remote support tools like TeamViewer, AnyDesk, or Microsoft Quick Assist to troubleshoot user endpoints. These tools utilize similar network ports and process behaviors (e.g., teamviewer.exe establishing outbound connections) that can mimic the connection patterns of PureRAT, triggering alerts on known IOCs.
  • Suggested Filter/Exclusion: Create an exclusion rule for processes running from trusted application paths (e.g., C:\Program Files\TeamViewer\, C:\Program Files (x86)\AnyDesk\) and restrict the alert to only trigger if the process hash does not match a known “Good” baseline in your EDR solution.

• Scenario: Scheduled Backup and Synchronization Jobs

  • Context: Automated backup agents such as Veeam Agent, Acronis Cyber Protect, or OneDrive for Business often execute scheduled tasks that involve heavy data exfiltration to cloud repositories. The detection logic may flag the large outbound volume of these synchronization jobs as potential PureRAT data theft, especially if they connect to external IPs that overlap with known PureRAT C2 servers.
  • Suggested Filter/Exclusion: Implement a time-based filter to suppress alerts for these specific processes during defined maintenance windows (e.g., 01:00–05:00 local time). Additionally, exclude traffic destined for verified backup cloud endpoints (e.g., *.veeam.com, *.office365.com) from the rule’s scope.

• Scenario: DevOps CI/CD Pipeline Artifact Transfers