ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the PureRAT remote access trojan by identifying specific indicators of compromise within Azure Sentinel logs. Proactively hunting for these signals is critical to rapidly identify and contain potential lateral movement or data exfiltration attempts before they escalate into broader incidents.

IOC Summary

Malware Family: PureRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["163.5.210.229", "172.111.198.212"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["163.5.210.229", "172.111.198.212"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: PureRAT IOCs detection rule in an enterprise environment:

• Scenario: Endpoint Security Agent Communication with Threat Intelligence Feeds

  • Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently query external threat intelligence platforms to update their local reputation databases. If the PureRAT IOCs include specific hash values or domain names that overlap with a vendor’s update server, legitimate telemetry traffic may trigger an alert.
  • Filter/Exclusion: Create a rule exclusion based on the Source Process Name matching known EDR agents (e.g., FalconSensor.exe, MsMpEng.exe) and restrict the detection to exclude traffic originating from the specific subnet range dedicated to security infrastructure or whitelisted update servers.

• Scenario: Scheduled Administrative Script Execution via Task Scheduler

  • Context: IT Operations teams often deploy scheduled PowerShell scripts using Windows Task Scheduler (SchTasks.exe) to perform routine maintenance, such as log rotation or asset inventory collection. If a script utilizes a library or connects to an external API that shares the same IOCs (e.g., specific DNS queries or file hashes) identified by PureRAT, it will generate false positives during the scheduled window.
  • Filter/Exclusion: Implement a time-based exclusion for alerts generated between 02:00 and 05:00 local time on weekdays, specifically filtering out events where the Parent Process Name is SchTasks.exe or TaskScheduler.exe, provided the user context is a dedicated service account (e.g., DOMAIN\svc-admin-maintenance).

• Scenario: Software Deployment via Configuration Management Tools

  • Context: During mass software deployments, tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ansible