ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior involving the initial deployment and command-and-control activities of the PureRAT remote access trojan by matching network traffic against a curated set of ten specific indicators of compromise. The SOC team should proactively hunt for these IOCs within Azure Sentinel to rapidly identify early-stage infections, as PureRAT’s ability to establish persistent backdoors can lead to significant data exfiltration and lateral movement if left undetected.

IOC Summary

Malware Family: PureRAT Total IOCs: 10 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`144[.]31[.]6[.]0:443`	botnet_cc	2026-09-01	75%
ip:port	`38[.]18[.]228[.]183:56001`	botnet_cc	2026-09-01	50%
ip:port	`91[.]219[.]237[.]84:56001`	botnet_cc	2026-09-01	50%
ip:port	`91[.]219[.]236[.]190:56001`	botnet_cc	2026-09-01	50%
ip:port	`104[.]254[.]90[.]162:28471`	botnet_cc	2026-09-01	50%
ip:port	`64[.]89[.]160[.]47:56001`	botnet_cc	2026-09-01	50%
ip:port	`151[.]241[.]99[.]28:56001`	botnet_cc	2026-09-01	50%
ip:port	`181[.]215[.]47[.]151:56001`	botnet_cc	2026-09-01	50%
ip:port	`163[.]245[.]205[.]142:56001`	botnet_cc	2026-09-01	50%
ip:port	`195[.]20[.]115[.]25:56001`	botnet_cc	2026-09-01	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["91.219.237.84", "181.215.47.151", "91.219.236.190", "144.31.6.0", "151.241.99.28", "163.245.205.142", "104.254.90.162", "195.20.115.25", "64.89.160.47", "38.18.228.183"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.219.237.84", "181.215.47.151", "91.219.236.190", "144.31.6.0", "151.241.99.28", "163.245.205.142", "104.254.90.162", "195.20.115.25", "64.89.160.47", "38.18.228.183"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the ThreatFox: PureRAT IOCs detection rule:

Scenario: Legitimate Endpoint Security Management via Admin Workstations
- Context: Enterprise administrators frequently use centralized management consoles (e.g., Microsoft SCCM, Ivanti Neurons, or CrowdStrike Falcon) to push updates or scan agents. If the PureRAT IOCs include specific hash values or network destinations that overlap with these vendor update servers or administrative jump hosts, legitimate traffic from known admin accounts will trigger alerts.
- Filter/Exclusion: Exclude network connections and process executions originating from the Domain Admins group or specific “Jump Host” IP ranges (e.g., 10.20.30.0/24) when the source process is a known security agent (e.g., C:\Program Files\CrowdStrike\csagent.exe).
Scenario: Scheduled Backup and Data Archiving Jobs
- Context: Automated backup solutions like Veeam, Commvault, or Rubrik often utilize specific network ports and file hashes that may match PureRAT indicators. These jobs typically run during off-hours via Windows Task Scheduler or cron jobs, generating high-volume data transfers to storage repositories that could be flagged as suspicious command-and-control (C2) activity.
- Filter/Exclusion: Create a rule exclusion for process executions where the parent process is VeeamBackup.exe or commvault.cmd, and the destination IP belongs to the internal backup subnet (e.g., 192.168.50.0/24). Additionally, exclude alerts occurring during defined maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Software Deployment and Patching via Configuration Management
- Context: