ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior involving the deployment of the PureLogs Stealer malware to exfiltrate sensitive credentials and data from endpoints within the Azure Sentinel environment. Proactive hunting for these specific IOCs is critical because the stealer’s high severity indicates a significant risk of lateral movement and data compromise that may evade standard signature-based detections until after initial infection occurs.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["103.219.153.251", "203.159.90.151"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.219.153.251", "203.159.90.151"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the ThreatFox: PureLogs Stealer IOCs detection rule:

• Scenario: A DevOps engineer runs a nightly automated backup script using Veeam Backup & Replication, which queries the same file paths or registry keys monitored by the PureLogs Stealer logic to verify data integrity before archiving.

  • Filter/Exclusion: Create an exclusion rule for the specific service account (svc-veeam-backup) and the executable path C:\Program Files\Veeam\BackupAndReplication\bin\Veeam.BackupService.exe when accessing the monitored IOCs during the scheduled maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: The IT Security team executes a quarterly vulnerability assessment using Tenable Nessus, which performs deep system scans that trigger network connections and registry modifications matching the PureLogs Stealer’s communication patterns.

  • Filter/Exclusion: Exclude traffic originating from the dedicated scanner IP range (10.20.50.x) and filter out alerts where the parent process is Nessus.exe or Tenable.Security.Scanner.exe.

• Scenario: An administrator manually deploys a new endpoint protection policy via Microsoft Endpoint Configuration Manager (MECM), which triggers a background service to download configuration manifests from a known internal repository, mimicking the stealer’s data exfiltration behavior.

  • Filter/Exclusion: Add an exclusion for the SMS_EXECUTIVE process and any activity occurring within the C:\Windows\CCM directory structure when the destination IP belongs to the internal corporate DNS suffix (e.g., .corp.local).

• Scenario: A scheduled PowerShell job runs a compliance audit script that enumerates user profiles and logs, utilizing specific API calls and file access patterns