ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of PureLogs Stealer malware by monitoring for specific Indicators of Compromise (IOCs) known to facilitate data exfiltration and credential theft. A SOC team should proactively hunt for these signals in Azure Sentinel to identify early-stage infections before sensitive information is compromised, given the high severity associated with this stealer’s ability to silently extract critical assets from endpoints.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["91.219.238.166", "142.132.253.231"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.219.238.166", "142.132.253.231"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: PureLogs Stealer IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Endpoint Protection Scanning

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download definition updates or scan specific file hashes that match the PureLogs Stealer IOCs. These tools often generate process executions or network connections using the exact same hash signatures identified in the threat hunt package during routine maintenance windows.
  • Suggested Filter/Exclusion: Create a rule exclusion based on Process Name and Parent Process. Exclude alerts where the process_name matches known EDR binaries (e.g., FalconSensor.exe, MsMpEng.exe) or where the parent process is the EDR service itself. Additionally, filter out events occurring during defined “Maintenance Windows” (e.g., 02:00–04:00 UTC) if the IOCs are static hashes known to be benign in your environment.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Automated backup solutions like Veeam, Commvault, or native Windows Task Scheduler jobs often compress and transfer log files or configuration data that contain file hashes identical to the PureLogs Stealer IOCs. These scheduled tasks run nightly and may trigger network connections or file access events that mimic the stealer’s behavior of exfiltrating logs.
  • Suggested Filter/Exclusion: Implement an exclusion based on Account Name and Scheduled Task ID. Exclude alerts generated by service accounts dedicated to backups (e.g., svc_backup_veeam, SYSTEM) or specific task paths (e.g., \Microsoft\Windows\Backup). If the detection logic relies on file hash matching, add a whitelist of known backup job hashes that overlap with the