ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the PureLogs Stealer malware by identifying specific indicators of compromise such as malicious file hashes and network connections that signal active data exfiltration attempts. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain stealthy credential theft operations before sensitive information is compromised.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 3 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["104.168.5.30", "193.26.115.118"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.168.5.30", "193.26.115.118"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - PureLogs Stealer
let malicious_domains = dynamic(["logs.bestshoppingday.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: PureLogs Stealer IOCs detection rule, along with targeted exclusion strategies suitable for an enterprise environment:

• Scenario: Automated Backup and Logging Agents

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize the PureLogs service name (or similar naming conventions) to aggregate logs from virtual machines. These agents frequently scan specific directories for log files, generating network traffic and file access patterns that match the PureLogs Stealer’s IOCs regarding data exfiltration and registry modification.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name (VeeamBackupService.exe or rubrik-agent) and User Context. Exclude alerts where the initiating process is running under a dedicated service account (e.g., DOMAIN\svc_backup) rather than an interactive user session.

• Scenario: Scheduled Compliance Reporting Jobs

  • Context: Internal compliance teams often run nightly jobs using tools like Splunk Universal Forwarder or SolarWinds LogCollector. These scheduled tasks are configured to read, compress, and transmit log data from the C:\ProgramData\PureLogs directory. The detection logic may misinterpret this high-volume file I/O and outbound network connection as a stealer attempting to harvest credentials and logs.
  • Filter/Exclusion: Implement an exclusion based on Scheduled Task Name (e.g., Daily_Log_Archive_Job) and Time Window. Configure the rule to suppress alerts occurring between 02:00 and 04:00 UTC if the source process is identified as a known logging agent.

• Scenario: Endpoint Detection and Response (EDR) Telemetry

  • Context: Modern EDR platforms such as **