ThreatFox: PureRAT IOCs

Hunt Hypothesis

This hunt identifies potential PureRAT infections by correlating network traffic with known indicators of compromise, targeting the remote access trojan’s ability to establish persistent control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to detect stealthy lateral movement or command-and-control sessions before the adversary can escalate privileges or exfiltrate sensitive data.

IOC Summary

Malware Family: PureRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["80.76.49.48", "31.76.125.23"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["80.76.49.48", "31.76.125.23"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureRAT

False Positive Guidance

• Legacy Application Deployment via Group Policy

  • Scenario: An IT administrator deploys a legacy line-of-business application that bundles a custom installer script or helper executable. This installer may contain hardcoded strings or binary patterns that match the specific IOCs (e.g., specific hash values or file paths) associated with PureRAT, particularly if the vendor has not updated their build artifacts to avoid known threat signatures.
  • Filter/Exclusion: Exclude processes originating from the specific application’s installation directory (e.g., C:\Program Files\LegacyApp\Installer\*) or exclude events where the parent process is gpupdate.exe or mstsc.exe during a documented GPO refresh cycle.

• Third-Party Remote Support Tooling

  • Scenario: Enterprise support teams use commercial remote assistance tools (such as TeamViewer, AnyDesk, or LogMeIn) that inject helper processes or create temporary files in standard user profile directories. If these tools use generic naming conventions or share memory regions with the PureRAT IOCs, the detection logic may flag the support agent’s helper process as malicious.
  • Filter/Exclusion: Exclude processes whose parent is a known remote support executable (e.g., TeamViewer.exe, AnyDesk.exe) or exclude file paths under C:\Users\<username>\AppData\Local\Temp\ that match the specific IOC filename pattern if the file size and creation time align with recent support sessions.

• Scheduled Backup or Log Rotation Jobs

  • Scenario: A scheduled task runs a custom PowerShell or batch script to rotate logs or compress backup archives. If the script creates a temporary archive file (e.g., backup_YYYYMMDD.zip) in a location that matches the PureRAT IOC path or if the compression tool (e.g., 7z.exe) is invoked with arguments that trigger