This detection identifies adversary activity involving the PureLogs Stealer by monitoring for six specific indicators of compromise that signal potential credential and data theft within the environment. A proactive hunt is essential in Azure Sentinel to rapidly identify and isolate infected endpoints before attackers can exfiltrate sensitive information or establish persistent access.
Malware Family: PureLogs Stealer Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 64[.]89[.]160[.]76:8443 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 64[.]89[.]160[.]76:8288 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 64[.]89[.]160[.]76:9508 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 64[.]89[.]160[.]76:465 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 185[.]242[.]3[.]65:9001 | botnet_cc | 2026-08-04 | 75% |
| ip:port | 65[.]21[.]212[.]79:62020 | botnet_cc | 2026-08-04 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["185.242.3.65", "64.89.160.76", "65.21.212.79"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.242.3.65", "64.89.160.76", "65.21.212.79"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: PureLogs Stealer IOCs detection rule, including targeted filters and exclusions tailored for an enterprise environment:
Scenario: Legitimate Backup Operations via Veeam or Commvault
VeeamAgent.exe or commvault.cmd) frequently access log directories (C:\ProgramData\..., %TEMP%) to archive logs before rotation. This behavior mimics the PureLogs Stealer’s file enumeration and reading patterns, triggering hits on IOCs related to specific log file paths or hash signatures that overlap with backup software components.ProcessName matches VeeamAgent.exe, commvault.cmd, or wbengine.exe AND the parent process is a known service account (e.g., NT SERVICE\VeeamBackupService).Scenario: Scheduled Compliance Audit Scripts
PowerShell.exe) via Task Scheduler to audit log integrity or aggregate logs for compliance reporting (e.g., SOC 2, HIPAA). These scripts actively query and copy specific .log files defined in the PureLogs IOC list, causing false alerts when the script accesses the same file hashes monitored by the rule.PowerShell.exe where the CommandLine contains keywords like -File, “Audit”, or “Compliance” AND the execution occurs during defined maintenance windows (e.g., 02:00–04:00 daily).Scenario: Endpoint Detection and Response (EDR) Telemetry Collection
csfalcon.exe) or Microsoft Defender