ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of PureRAT remote access trojans by monitoring for specific indicators of compromise across the Azure Sentinel environment. Proactively hunting for these 14 IOCs is critical to identify early-stage lateral movement and command-and-control communications, enabling the SOC team to contain potential data exfiltration before it escalates into a full-scale breach.

IOC Summary

Malware Family: PureRAT Total IOCs: 14 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`91[.]92[.]243[.]114:443`	botnet_cc	2026-08-15	75%
ip:port	`147[.]45[.]61[.]65:443`	botnet_cc	2026-08-15	75%
ip:port	`94[.]143[.]231[.]61:443`	botnet_cc	2026-08-14	75%
ip:port	`45[.]157[.]233[.]139:7000`	botnet_cc	2026-08-14	75%
ip:port	`2[.]59[.]133[.]115:56001`	botnet_cc	2026-08-14	75%
ip:port	`2[.]59[.]133[.]115:56002`	botnet_cc	2026-08-14	75%
ip:port	`2[.]59[.]133[.]115:56003`	botnet_cc	2026-08-14	75%
ip:port	`195[.]177[.]94[.]41:56003`	botnet_cc	2026-08-14	75%
ip:port	`172[.]236[.]157[.]30:443`	botnet_cc	2026-08-14	75%
ip:port	`147[.]45[.]61[.]65:56001`	botnet_cc	2026-08-14	75%
ip:port	`147[.]124[.]223[.]225:56003`	botnet_cc	2026-08-14	75%
ip:port	`108[.]187[.]7[.]173:443`	botnet_cc	2026-08-14	75%
ip:port	`108[.]187[.]7[.]180:443`	botnet_cc	2026-08-14	75%
ip:port	`104[.]164[.]46[.]182:443`	botnet_cc	2026-08-14	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["108.187.7.173", "94.143.231.61", "195.177.94.41", "108.187.7.180", "45.157.233.139", "172.236.157.30", "147.45.61.65", "147.124.223.225", "104.164.46.182", "91.92.243.114", "2.59.133.115"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["108.187.7.173", "94.143.231.61", "195.177.94.41", "108.187.7.180", "45.157.233.139", "172.236.157.30", "147.45.61.65", "147.124.223.225", "104.164.46.182", "91.92.243.114", "2.59.133.115"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: PureRAT IOCs detection rule in an enterprise environment:

Scenario: Enterprise Endpoint Protection Scanning
- Context: The organization utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint (MDE). During scheduled malware definition updates or on-demand scans, the EDR agent may query external reputation services that share IP ranges or domain names with PureRAT’s infrastructure. If the detection logic flags network connections to these specific IOCs without context, legitimate scanning traffic will trigger alerts.
- Filter/Exclusion: Create an exclusion rule in the SIEM (e.g., Splunk or Sentinel) to suppress alerts where the Source Process Name matches known EDR agents (FalconSensor.exe, MsMpEng.exe) and the Process Command Line contains keywords like “scan”, “update”, or “reputation”.
Scenario: Scheduled Software Deployment Jobs
- Context: The IT Operations team uses Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons to push patches and software updates. These tools often utilize a central management server that hosts components with IOCs overlapping with PureRAT’s known infrastructure (e.g., specific update servers or license verification endpoints). When the scheduled job runs, it generates network traffic matching the detection logic.
- Filter/Exclusion: Implement a time-based exclusion for alerts originating from SCCM or Ivanti management services during defined maintenance windows (e.g., 02:00 – 06:00 UTC). Additionally, exclude alerts where the Source Host Group is tagged as “Patch-Server” or “Deployment-Agent”.
Scenario: Third-Party Cloud Backup and Sync Services
- Context: Users utilize **OneDrive