ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of PureLogs Stealer malware by monitoring for specific indicators of compromise that target sensitive data exfiltration and credential theft. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections before attackers can establish persistence or escalate privileges within the cloud environment.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 6 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - PureLogs Stealer
let malicious_domains = dynamic(["voucher-01-static.com", "relay-01-static.com", "relay-02-static.com", "strang-02-static.com", "adobeartsia.com", "boltiviersoul.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureLogs Stealer IOCs detection rule, along with targeted filtering strategies:

• Scenario: Enterprise Backup Agents Scanning Log Directories

  • Context: Scheduled backup jobs (e.g., Veeam, Commvault, or Rubrik) frequently scan and archive the specific log directories where PureLogs Stealer targets user data. The IOCs may match file hashes of legitimate log rotation scripts or temporary staging files created during these backups.
  • Filter/Exclusion: Exclude processes running under the Veeam.Backup.Service or Commvault.ClientService accounts, and filter out alerts where the parent process is a known backup service (e.g., vbr.exe, commagentd) operating on paths containing \Logs\ or \Archive\.

• Scenario: Endpoint Detection & Response (EDR) Telemetry Collection

  • Context: Native EDR agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne actively monitor file system changes. When these agents perform deep scans of user profiles to detect anomalies, their telemetry collection modules may generate network connections or process executions that mimic the IOCs defined in the PureLogs Stealer hunt package.
  • Filter/Exclusion: Create an exclusion rule for processes with names FalconSensor.exe, MsMpEng.exe (Microsoft Defender), and SentinelOneAgent.exe. Additionally, exclude alerts where the execution path resides within the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\).

• Scenario: Automated Compliance Reporting Scripts

  • Context: IT Audit teams often deploy PowerShell scripts or Python-based tools to aggregate logs for compliance reporting (e.g., GDPR, SOC2). These scripts frequently read from and write to the same file paths targeted by PureLogs