ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of PureLogs Stealer malware by monitoring for three specific Indicators of Compromise (IOCs) that signal active data theft and credential harvesting within the environment. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify compromised endpoints, contain potential lateral movement, and prevent sensitive information exfiltration before broader network impact occurs.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["141.98.10.179", "46.151.182.172", "46.151.182.159"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["141.98.10.179", "46.151.182.172", "46.151.182.159"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: PureLogs Stealer IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Legitimate Endpoint Protection Scans

  • Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently scan the C:\Program Files\PureLogs directory or specific log files during scheduled maintenance windows. If the PureLogs Stealer IOCs include file hashes or process names that overlap with legitimate scanner components, the rule may trigger when the EDR agent accesses these artifacts.
  • Filter/Exclusion: Exclude processes where ProcessName matches known security agents (e.g., FalconSensorService.exe, MsMpEng.exe) and filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) on non-critical workstations.

• Scenario: Scheduled Backup Jobs Accessing Log Directories

  • Context: Automated backup solutions like Veeam or Commvault often run scheduled jobs that traverse the C:\Logs\PureLogs directory to archive data. If the PureLogs Stealer IOCs include specific file paths or registry keys accessed during these backups, the rule may flag the backup service as a potential stealer activity.
  • Filter/Exclusion: Create an exclusion for process names associated with backup services (e.g., Veeam.Backup.Service.exe, vcagent.exe) and restrict the detection logic to exclude events where the parent process is a known scheduled task runner (Taskeng.exe or svchost.exe -k netsvcs).

• Scenario: Admin Deployment of PureLogs Monitoring Agents

  • Context: During software deployment cycles, System Administrators use tools like SCCM (Microsoft Endpoint Configuration Manager