ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt identifies the presence of PureLogs Stealer, a credential and data theft malware, by correlating its known IOCs against Azure Sentinel telemetry to detect active compromise. Proactively hunting for these indicators is critical because this stealer often operates silently to exfiltrate sensitive information, allowing the SOC to identify and isolate affected assets before the adversary achieves their objective.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 8 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["64.89.160.140"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.89.160.140"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - PureLogs Stealer
let malicious_urls = dynamic(["https://pullout.ezgateway.net:587/discord", "https://pullout.ezgateway.net:587/filesearch/req", "https://pullout.ezgateway.net:587/finish", "https://pullout.ezgateway.net:587/plugin", "https://pullout.ezgateway.net:587/userinfo", "https://pullout.ezgateway.net:587/browser", "https://pullout.ezgateway.net:587/ping"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

• Scenario: A DevOps team deploys a custom log aggregation pipeline using PureLogs (or a similarly named internal utility) to parse and store application logs in a central data lake, triggering matches on the binary name or specific hash if the tool is built from the same open-source base.
  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., jenkins.exe, azure-agent.exe, github-actions.exe) or where the command line contains specific arguments like --parse or --upload that indicate legitimate log processing rather than credential theft.
• Scenario: An IT administrator runs a scheduled PowerShell script to clean up temporary files and old logs in the C:\Users\Public\Temp directory, which inadvertently executes a helper script named purelogs_clean.ps1 that matches the IOC filename pattern.
  • Filter/Exclusion: Exclude executions where the file path resides in standard temporary directories (%TEMP%, C:\Windows\Temp) and the parent process is powershell.exe or pwsh.exe with a scheduled task ID (e.g., Task Scheduler or cron equivalent) that is whitelisted in the CMDB.
• Scenario: A security team performs a red team exercise or threat hunt simulation using a modified version of the PureLogs Stealer to test detection coverage, running it from a dedicated test account or isolated VM.
  • Filter/Exclusion: Exclude events where the user account belongs to a specific security group (e.g., SEC_REDTEAM_TEST) or where the machine name matches a known test environment pattern (e.g., *TEST*, *SIM*), or where the process is executed from a dedicated test directory like C:\RedTeam\Tools\.
• Scenario: A third-party backup or