ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt targets adversaries deploying PureLogs Stealer malware to exfiltrate sensitive credentials and system data through covert command-and-control channels initiated by phishing or network exploits. Proactively hunting for these specific traffic patterns and process anomalies in Azure Sentinel is critical to detect early-stage lateral movement and prevent widespread credential compromise before the malware establishes a persistent foothold.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["46.151.182.159", "5.101.84.80", "141.98.10.188"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.151.182.159", "5.101.84.80", "141.98.10.188"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: PureLogs Stealer IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

• Automated Patch Management & Software Updates

  • Scenario: Enterprise patch management tools (e.g., Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti) frequently establish outbound connections to vendor update servers. These processes often download large payloads and execute temporary installers that mimic the “unexpected process execution” and “unusual outbound traffic” signatures of PureLogs Stealer, particularly when updating critical security agents or browsers.
  • Filter/Exclusion: Create a whitelist exclusion for known patch management service accounts (e.g., NT SERVICE\ccmexec) and specific executable paths (C:\Windows\CCM\*). Additionally, exclude outbound traffic to trusted vendor IP ranges (e.g., Microsoft Update servers) during standard maintenance windows.

• Scheduled Cloud Backup & Data Synchronization Jobs

  • Scenario: Scheduled backup agents (such as Veeam Agent, Rubrik, or Microsoft Azure Backup) perform regular data exfiltration to cloud storage endpoints. These jobs generate high-volume outbound traffic and spawn helper processes that scan system information, which can be misidentified by the rule as the “covert communication” and “sensitive data exfiltration” behaviors of the stealer.
  • Filter/Exclusion: Exclude network flows originating from backup service executables (e.g., VeeamAgent.exe, AzBackupSvc.exe) connecting to known cloud storage CIDR blocks. Implement a time-based filter to suppress alerts for these specific processes during their defined maintenance windows (e.g., 02:00–06:00 local time).

• Third-Party Endpoint Detection and Response (EDR) Scans