This hunt identifies network connections to known PureRAT command-and-control infrastructure, indicating potential remote access trojan activity that enables adversaries to execute arbitrary commands and exfiltrate data. Proactively hunting for these IOCs in Azure Sentinel is critical because PureRAT is frequently deployed in initial access stages, allowing attackers to establish persistent footholds before traditional endpoint detections can trigger.
Malware Family: PureRAT Total IOCs: 19 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]56[.]165[.]197:56003 | botnet_cc | 2026-09-05 | 75% |
| ip:port | 196[.]81[.]251[.]114:443 | botnet_cc | 2026-09-05 | 75% |
| ip:port | 185[.]233[.]164[.]109:443 | botnet_cc | 2026-09-05 | 75% |
| ip:port | 94[.]154[.]32[.]8:56001 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 94[.]154[.]32[.]8:56002 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 84[.]200[.]77[.]29:56003 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 80[.]97[.]160[.]38:443 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 196[.]251[.]121[.]124:6767 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 195[.]177[.]94[.]11:56001 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 195[.]177[.]94[.]11:56002 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 183[.]90[.]187[.]2:2025 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 183[.]90[.]187[.]73:2025 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 183[.]90[.]187[.]111:2025 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 172[.]81[.]132[.]156:56003 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 153[.]75[.]95[.]181:56002 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 153[.]75[.]95[.]181:56001 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 150[.]241[.]66[.]55:56003 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 150[.]241[.]66[.]55:56001 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 150[.]241[.]66[.]55:56002 | botnet_cc | 2026-09-04 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureRAT
let malicious_ips = dynamic(["153.75.95.181", "150.241.66.55", "183.90.187.73", "80.97.160.38", "196.251.121.124", "183.90.187.2", "196.81.251.114", "185.233.164.109", "195.177.94.11", "172.81.132.156", "183.90.187.111", "84.200.77.29", "45.56.165.197", "94.154.32.8"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["153.75.95.181", "150.241.66.55", "183.90.187.73", "80.97.160.38", "196.251.121.124", "183.90.187.2", "196.81.251.114", "185.233.164.109", "195.177.94.11", "172.81.132.156", "183.90.187.111", "84.200.77.29", "45.56.165.197", "94.154.32.8"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
java runtime or a custom JAR file that matches one of the PureRAT hash IOCs due to shared library dependencies or similar compilation artifacts.
java.exe or javaw.exe and the file path resides under the application’s installation directory (e.g., C:\Program Files\InternalERP\lib\).Rufus for USB creation or a specific 7-Zip archive extraction utility) that contains a binary or temporary file matching a PureRAT IOC hash, often because the tool was downloaded from a non-standard source or is an older build.
7z.exe, Rufus.exe, or similar known utility names, and the user account belongs to the IT_Admins or Service_Accounts security group.%TEMP% or %LOCALAPPDATA% which match a PureRAT IOC, particularly if the utility is a generic md5sum wrapper or a specific archive tool like WinRAR used in automation.
\Temp\ or \Local\Temp\ and the parent process is cmd.exe, powershell.exe, or wscript.exe, provided the user account is a known service account (e.g., svc_backup, svc_maintenance).