This hunt detects adversary behavior involving the deployment of PureRAT remote access tools by matching network and endpoint telemetry against a curated set of 20 known Indicators of Compromise (IOCs). Proactive hunting for these signatures in Azure Sentinel is critical to identify early-stage lateral movement and command-and-control communications before they escalate into full-scale data exfiltration incidents.
Malware Family: PureRAT Total IOCs: 20 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 56[.]69[.]251[.]23:443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 38[.]240[.]48[.]155:443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 217[.]60[.]195[.]139:443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 203[.]202[.]232[.]132:443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 154[.]201[.]82[.]105:56002 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 154[.]201[.]82[.]106:56002 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 144[.]31[.]6[.]21:443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 91[.]215[.]85[.]10:56001 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 45[.]66[.]217[.]107:56001 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 108[.]187[.]4[.]95:56001 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 167[.]148[.]201[.]29:56001 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 178[.]16[.]53[.]120:56001 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 45[.]141[.]21[.]54:56001 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 138[.]124[.]60[.]14:5357 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 77[.]110[.]126[.]19:5357 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 77[.]110[.]125[.]165:57888 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 185[.]198[.]58[.]107:56001 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 185[.]198[.]58[.]107:56002 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 185[.]198[.]58[.]107:56003 | botnet_cc | 2026-08-27 | 75% |
| domain | c2.ethanremote.co.uk | botnet_cc | 2026-08-27 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["217.60.195.139", "38.240.48.155", "108.187.4.95", "167.148.201.29", "77.110.126.19", "185.198.58.107", "56.69.251.23", "203.202.232.132", "144.31.6.21", "154.201.82.106", "77.110.125.165", "154.201.82.105", "91.215.85.10", "45.66.217.107", "45.141.21.54", "138.124.60.14", "178.16.53.120"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.195.139", "38.240.48.155", "108.187.4.95", "167.148.201.29", "77.110.126.19", "185.198.58.107", "56.69.251.23", "203.202.232.132", "144.31.6.21", "154.201.82.106", "77.110.125.165", "154.201.82.105", "91.215.85.10", "45.66.217.107", "45.141.21.54", "138.124.60.14", "178.16.53.120"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - PureRAT
let malicious_domains = dynamic(["c2.ethanremote.co.uk"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: Legitimate Endpoint Protection Updates
FalconSensor.exe (or MsMpEng.exe) and restrict it to the specific time window of 02:00–04:00 UTC. Additionally, exclude alerts where the parent process is the EDR service itself rather than a user interactive session.Scenario: Automated Backup Jobs via PowerShell
System.Management.Automation. The script utilizes a third-party compression library (e.g., DotNetZip) that shares an identical file hash with one of the PureRAT IOCs, triggering a false hit during execution.powershell.exe and the command line contains specific keywords like -ScheduledJob or references to internal backup paths (e.g., \\BackupServer\Logs). Implement a whitelist for the specific hash of the compression DLL used in this script.Scenario: Internal DevOps Deployment Pipeline