ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the PureRAT remote access trojan by monitoring for matches against a curated set of twelve specific indicators of compromise within Azure Sentinel logs. Proactively hunting for these IOCs is critical to identify early-stage infections and prevent potential data exfiltration or lateral movement before the malware establishes persistence on compromised endpoints.

IOC Summary

Malware Family: PureRAT Total IOCs: 12 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["38.240.57.198", "103.54.153.49", "193.138.195.29", "172.111.134.94", "189.93.202.137", "196.251.121.59"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.240.57.198", "103.54.153.49", "193.138.195.29", "172.111.134.94", "189.93.202.137", "196.251.121.59"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - PureRAT
let malicious_domains = dynamic(["rx7brabo.ddns.com.br"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Security Tool Telemetry & Update Scans

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black frequently scan the network against known threat intelligence feeds. These tools often initiate outbound connections to ThreatFox’s update servers or internal IOC repositories, matching the PureRAT hash signatures or network indicators within their own update mechanisms.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name of the security agent (e.g., C:\Program Files\CrowdStrike\fs_qa.exe) and exclude traffic originating from the specific IP ranges of the threat intelligence management platform or the EDR update servers.

• Scenario: Scheduled Admin Maintenance Jobs

  • Context: Enterprise IT teams utilize Windows Task Scheduler or Ansible Automation Platform to run nightly maintenance scripts that include vulnerability scanning and IOC validation. These jobs often execute PowerShell scripts (powershell.exe) or batch files that query external threat databases, inadvertently triggering the PureRAT network connection logic defined in the hunt package.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00–04:00 local time) for processes running under the SYSTEM or specific Domain Admin accounts, specifically filtering out connections initiated by known maintenance scripts like VulnScan.ps1 or Ansible runner processes.

• Scenario: Cloud Backup and Synchronization Services

  • Context: Enterprise backup solutions such as Veeam, Rubrik, or Microsoft OneDrive for Business perform incremental syncs that involve