This hunt identifies potential PureRAT infections by correlating known indicators of compromise with network and endpoint telemetry to detect the presence of this remote access trojan. Proactively hunting for these IOCs is critical because PureRAT provides adversaries with persistent remote control capabilities, enabling them to execute commands, steal data, and pivot within the environment before traditional detections trigger.
Malware Family: PureRAT Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 31[.]56[.]209[.]53:1111 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 217[.]156[.]66[.]203:3609 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 172[.]86[.]91[.]14:56001 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 172[.]86[.]91[.]14:56002 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 15[.]235[.]149[.]212:56002 | botnet_cc | 2026-09-17 | 75% |
| ip:port | 124[.]198[.]131[.]60:4782 | botnet_cc | 2026-09-17 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["15.235.149.212", "217.156.66.203", "172.86.91.14", "124.198.131.60", "31.56.209.53"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["15.235.149.212", "217.156.66.203", "172.86.91.14", "124.198.131.60", "31.56.209.53"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
jenkins-agent.exe or gitlab-runner) or filter events where the parent process is a known build tool and the execution path resides within the standard workspace directory (e.g., C:\Jenkins\workspace\).hey or wrk compiled with specific flags) that may mimic the behavioral IOCs of PureRAT, particularly regarding network connection patterns or specific registry keys used for persistence during testing. Filter out alerts where the executable name matches known internal tooling names (e.g., loadgen.exe, chaos-agent) or where the process is launched by a scheduled task explicitly named Internal-LoadTest or Chaos-Engineering.HKCU\Software\Microsoft\Windows\CurrentVersion\Run or download payloads to %TEMP% with generic names like update.exe or helper.dll, which can collide with PureRAT’s persistence IOCs. Exclude events where the parent process is a known legacy application service (e.g., AdobeGenuineSoftware or JavaWebStart.exe) and the file path contains AppData\Local\Temp or Program Files for that specific vendor.