This detection rule identifies PureRAT activity by monitoring for remote access trojan behaviors such as data exfiltration, arbitrary command execution, and persistent C2 communication via compromised domains and IP:port pairs. Proactive hunting in Azure Sentinel is critical to uncover early-stage compromises driven by phishing or exploit kits before adversaries establish deep footholds within the network.
Malware Family: PureRAT Total IOCs: 35 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]215[.]85[.]6:56001 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 91[.]215[.]85[.]6:56002 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 91[.]215[.]85[.]6:56003 | botnet_cc | 2026-08-20 | 75% |
| domain | 1hvnc.duckdns.org | botnet_cc | 2026-08-20 | 100% |
| ip:port | 167[.]17[.]76[.]105:56002 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 167[.]17[.]76[.]105:56003 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 167[.]17[.]76[.]105:56001 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 134[.]209[.]211[.]37:56002 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 134[.]209[.]211[.]37:56003 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 134[.]209[.]211[.]37:56001 | botnet_cc | 2026-08-20 | 75% |
| domain | connxt.ttlock.ma | botnet_cc | 2026-08-20 | 100% |
| domain | trump2[.]1368.lol | botnet_cc | 2026-08-20 | 100% |
| ip:port | 15[.]235[.]174[.]203:56002 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 15[.]235[.]174[.]203:56003 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 15[.]235[.]174[.]203:56001 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 15[.]235[.]176[.]216:56001 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 15[.]235[.]176[.]216:56002 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 15[.]235[.]176[.]216:56003 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 95[.]85[.]238[.]53:56002 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 95[.]85[.]238[.]53:56003 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 108[.]187[.]4[.]26:56001 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 108[.]187[.]4[.]26:56002 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 108[.]187[.]4[.]26:56003 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 130[.]250[.]191[.]154:56003 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 130[.]250[.]191[.]154:56002 | botnet_cc | 2026-08-20 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["64.188.91.241", "130.250.191.154", "167.17.76.105", "178.17.62.198", "134.209.211.37", "167.148.201.14", "108.187.4.26", "91.215.85.6", "15.235.174.203", "15.235.176.216", "95.85.238.53"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.188.91.241", "130.250.191.154", "167.17.76.105", "178.17.62.198", "134.209.211.37", "167.148.201.14", "108.187.4.26", "91.215.85.6", "15.235.174.203", "15.235.176.216", "95.85.238.53"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - PureRAT
let malicious_domains = dynamic(["1hvnc.duckdns.org", "connxt.ttlock.ma", "trump2.1368.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: PureRAT IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:
Legitimate Remote Support Sessions via Enterprise Tools
Zoom.exe, Teams.exe, or SplashtopRemoteAgent.exe and the destination ports match known enterprise support ranges. Additionally, add a filter to ignore connections initiated by accounts with the IT-Support group membership during business hours (08:00–18:00).Scheduled Cloud Backup and Sync Operations
svc-backup-agent) running on known backup servers. Filter alerts where the destination IP belongs to trusted cloud provider CIDR blocks (e.g., Microsoft Azure or AWS) and the traffic volume exceeds a baseline threshold typical of backup jobs rather than interactive C2 communication.Software Update Mechanisms from Trusted Vendors