This hunt targets the presence of known PureRAT indicators of compromise, which are frequently leveraged by adversaries to establish persistent remote access and execute malicious payloads within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, mitigating the risk of lateral movement and data exfiltration before the threat actor can fully establish a foothold.
Malware Family: PureRAT Total IOCs: 11 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 217[.]60[.]195[.]40:56001 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 217[.]60[.]195[.]40:56002 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 217[.]217[.]97[.]90:56003 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 196[.]251[.]121[.]124:443 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 195[.]177[.]94[.]100:56002 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 195[.]177[.]94[.]100:56003 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 195[.]177[.]94[.]100:56001 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 192[.]252[.]187[.]56:56002 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 172[.]111[.]198[.]212:56003 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 144[.]31[.]6[.]37:443 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 118[.]107[.]16[.]32:56001 | botnet_cc | 2026-09-11 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["196.251.121.124", "195.177.94.100", "217.60.195.40", "192.252.187.56", "172.111.198.212", "144.31.6.37", "118.107.16.32", "217.217.97.90"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["196.251.121.124", "195.177.94.100", "217.60.195.40", "192.252.187.56", "172.111.198.212", "144.31.6.37", "118.107.16.32", "217.217.97.90"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Application Deployment via Group Policy: Enterprise IT often deploys legacy line-of-business applications or drivers that may contain outdated or shared binary hashes matching PureRAT IOCs. If a specific executable (e.g., LegacyApp.exe) is deployed to all workstations via Group Policy Object (GPO) and its hash matches an IOC, it will trigger alerts on every endpoint.
C:\Program Files\LegacyApp\LegacyApp.exe with SHA256 abc123...). Alternatively, exclude the process if the parent process is gpupdate.exe or mstsc.exe during deployment windows.Third-Party Remote Support Tools: Support teams frequently use remote assistance tools like TeamViewer, AnyDesk, or LogMeIn. Some of these tools, or their helper components, may use memory regions or file paths that overlap with PureRAT’s known IOCs (e.g., specific DLL names or registry keys used for persistence). If a support engineer initiates a session, the tool’s behavior might mimic the IOCs.
C:\Program Files\TeamViewer\, C:\Program Files (x86)\AnyDesk\) or exclude events where the user account belongs to the RemoteSupport security group.Scheduled Maintenance Jobs: Automated maintenance scripts (e.g., disk cleanup, log rotation, or backup agents) often run as scheduled tasks under the SYSTEM or admin account. If these jobs create temporary files, modify specific registry keys, or use memory patterns that match PureRAT’s IOCs (such as specific rundll32 calls or file creation in Temp), they can trigger false positives.