ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the PureRAT remote access trojan by monitoring for matches against its specific set of Indicators of Compromise (IOCs). A SOC team should proactively hunt for these signals in Azure Sentinel to identify early-stage infections and prevent potential data exfiltration or lateral movement associated with this high-severity threat.

IOC Summary

Malware Family: PureRAT Total IOCs: 11 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]11[.]181[.]85:443`	botnet_cc	2026-08-18	75%
ip:port	`45[.]11[.]181[.]85:56001`	botnet_cc	2026-08-18	75%
ip:port	`185[.]254[.]99[.]153:56002`	botnet_cc	2026-08-18	75%
ip:port	`185[.]254[.]99[.]153:56003`	botnet_cc	2026-08-18	75%
ip:port	`178[.]211[.]155[.]154:443`	botnet_cc	2026-08-18	75%
ip:port	`176[.]96[.]138[.]71:443`	botnet_cc	2026-08-18	75%
ip:port	`172[.]252[.]172[.]30:56001`	botnet_cc	2026-08-18	75%
ip:port	`172[.]252[.]172[.]30:56002`	botnet_cc	2026-08-18	75%
ip:port	`172[.]252[.]172[.]30:56003`	botnet_cc	2026-08-18	75%
ip:port	`154[.]248[.]45[.]157:443`	botnet_cc	2026-08-18	75%
ip:port	`137[.]175[.]30[.]119:56003`	botnet_cc	2026-08-18	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["185.254.99.153", "176.96.138.71", "137.175.30.119", "172.252.172.30", "178.211.155.154", "45.11.181.85", "154.248.45.157"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.254.99.153", "176.96.138.71", "137.175.30.119", "172.252.172.30", "178.211.155.154", "45.11.181.85", "154.248.45.157"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Endpoint Protection Scans by Defender or CrowdStrike
- Scenario: The EDR agent (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled full scan or on-demand update check that resolves the same domain or IP address listed in the PureRAT IOC list. This often happens during off-hours maintenance windows where agents query external threat intelligence feeds.
- Filter/Exclusion: Exclude traffic originating from specific EDR service accounts (e.g., NT SERVICE\DefenderSvc or CrowdStrike Falcon Sensor) and restrict the rule to trigger only when the process is not a known security tool executable (e.g., exclude MsMpEng.exe, csagent.exe).
Software Supply Chain Updates via Chocolatey or SCCM
- Scenario: An automated deployment job using Microsoft Endpoint Configuration Manager (SCCM) or Chocolatey attempts to download patches for a third-party application. The update server or the artifact repository shares an IP address or domain with one of the PureRAT IOCs, triggering a hit during the nightly patch cycle.
- Filter/Exclusion: Create an exclusion based on the initiating process name (e.g., ccmsetup.exe, choco.exe) and limit detection to business hours only if the update job is known to run at 02:00 AM, or whitelist the specific IP ranges of the enterprise’s internal software distribution points.
IT Admin Remote Management Sessions
- Scenario: A System Administrator uses a remote management tool (such as TeamViewer, AnyDesk, or Microsoft Remote Desktop) to connect to a workstation that has previously communicated with a PureRAT IOC. The admin