ThreatFox: PureRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of PureRAT, a remote access trojan known for establishing persistent backdoors and enabling adversary command-and-control, by correlating its specific IOCs against Azure Sentinel telemetry. Proactively hunting for these indicators is critical to identify compromised endpoints early, as PureRAT often facilitates lateral movement and data exfiltration before traditional detection mechanisms trigger an alert.

IOC Summary

Malware Family: PureRAT Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`93[.]114[.]183[.]130:9090`	botnet_cc	2026-09-03	75%
ip:port	`23[.]175[.]48[.]78:443`	botnet_cc	2026-09-03	75%
ip:port	`158[.]94[.]211[.]158:443`	botnet_cc	2026-09-03	75%
ip:port	`195[.]20[.]115[.]238:56003`	botnet_cc	2026-09-03	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["158.94.211.158", "23.175.48.78", "195.20.115.238", "93.114.183.130"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["158.94.211.158", "23.175.48.78", "195.20.115.238", "93.114.183.130"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — PureRAT

False Positive Guidance

Scenario: A DevOps engineer manually deploys a lightweight monitoring agent or a custom Python-based health check script that utilizes the same hash or file path as one of the PureRAT IOCs for temporary diagnostic purposes.
- Filter/Exclusion: Exclude files located in specific staging or temporary directories (e.g., C:\Temp\, C:\Users\<User>\AppData\Local\Temp\) or exclude processes initiated by known service accounts (e.g., svc-deploy, devops-admin) when the parent process is a standard deployment tool like ansible-playbook.exe or terraform.exe.
Scenario: An IT administrator runs a legacy internal utility or a custom PowerShell script for password reset or user provisioning that shares a similar binary hash or naming convention with a PureRAT component, particularly if the utility is stored in a shared network drive or a non-standard application folder.
- Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the command line contains specific internal keywords (e.g., -ResetPwd, -ProvisionUser) or exclude paths within known internal software repositories (e.g., \\fileserver\it-tools\, C:\Program Files\InternalUtils\).
Scenario: A security team conducts a red team exercise or a vulnerability assessment using a tool that mimics PureRAT behavior or uses the same IOCs for testing purposes, leading to legitimate detection triggers during the engagement window.
- Filter/Exclusion: Implement a time-based exclusion or a tag-based filter (e.g., via Sentinel or QRadar) that suppresses alerts for these specific IOCs during known red team engagement windows, or exclude processes spawned by known red team tooling (e.g., cobaltstrike.exe, beacon.exe) or specific test user accounts (e.g.,