ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the PureRAT remote access trojan by identifying its specific indicators of compromise within network and endpoint telemetry. Proactively hunting for these IOCs in Azure Sentinel is critical to uncover early-stage lateral movement or command-and-control communications that may evade standard signature-based detections.

IOC Summary

Malware Family: PureRAT Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`95[.]133[.]229[.]173:443`	botnet_cc	2026-08-17	75%
ip:port	`83[.]136[.]211[.]230:443`	botnet_cc	2026-08-17	75%
ip:port	`217[.]60[.]195[.]226:443`	botnet_cc	2026-08-17	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["95.133.229.173", "83.136.211.230", "217.60.195.226"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["95.133.229.173", "83.136.211.230", "217.60.195.226"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, along with targeted filtering strategies:

Scenario: Legitimate RMM Agent Communication
- Context: Enterprise Remote Monitoring and Management (RMM) tools like ManageEngine Desktop Central, SolarWinds NCM, or Microsoft Endpoint Configuration Manager (MECM) often establish persistent connections to their management servers. These agents may use the same hash signatures, domain names, or IP ranges as PureRAT for telemetry reporting or policy updates.
- Filter/Exclusion: Create an exclusion rule that suppresses alerts if the source process is a known RMM agent (e.g., DesktopCentralAgent.exe, ccmexec.exe) AND the destination IP belongs to the internal management subnet (e.g., 10.20.x.x).
Scenario: Scheduled Security Tool Updates
- Context: Automated update jobs for security suites such as CrowdStrike Falcon, SentinelOne, or Trend Micro Apex One frequently download definition files and configuration scripts from their cloud repositories. If the PureRAT IOCs include specific certificate hashes or API endpoints used by these vendors, scheduled nightly updates will trigger the rule.
- Filter/Exclusion: Exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where the source process is falcon.sys or SentinelOne.exe, and the destination domain matches the vendor’s update CDN (e.g., *.crowdstrike.com).
Scenario: Admin-Driven Script Execution
- Context: System administrators often run PowerShell scripts or batch files to deploy configurations, patch applications, or query external threat intelligence feeds. If an admin manually executes a script that queries the specific PureRAT IO