This hypothesis targets the presence of known PureRAT indicators, which are frequently used by adversaries to establish persistent remote access and execute command-and-control operations within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised assets early, potentially before the malware leverages its capabilities for lateral movement or data exfiltration.
Malware Family: PureRAT Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]139[.]104[.]26:56013 | botnet_cc | 2026-09-13 | 75% |
| ip:port | 38[.]180[.]146[.]89:443 | botnet_cc | 2026-09-13 | 75% |
| ip:port | 31[.]56[.]209[.]63:8080 | botnet_cc | 2026-09-13 | 75% |
| ip:port | 196[.]251[.]121[.]238:5173 | botnet_cc | 2026-09-13 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["31.56.209.63", "38.180.146.89", "196.251.121.238", "45.139.104.26"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.56.209.63", "38.180.146.89", "196.251.121.238", "45.139.104.26"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
curl or wget command to download a specific PureRAT payload hash (e.g., SHA256: 4a5b...) from an internal artifact repository or a trusted third-party CDN for a penetration test or feature validation.
10.20.0.0/24) AND the process name is curl.exe or wget.exe AND the destination URL contains the internal artifact registry domain (e.g., artifacts.corp.com).Volatility or YARA that references PureRAT IOCs (such as specific mutex names or registry keys) to validate detection coverage in a lab environment.
yara64.exe, volatility3.exe, falcon-sensor.exe) AND the user account belongs to the SECURITY_LAB group.C:\Users\Public\pure_rat.exe) or registry keys to confirm eradication.
powershell.exe or cmd.exe AND the command line contains keywords like Remove-Item, del, or reg delete AND the user account is in the IT_ADMIN group.