ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt hypothesis detects adversary behavior involving the execution of known PureLogs Stealer indicators to identify active data exfiltration and credential theft campaigns within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly isolate compromised endpoints before sensitive information is fully extracted by this high-severity stealer.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["2.56.245.239", "216.250.249.188"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["2.56.245.239", "216.250.249.188"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: PureLogs Stealer IOCs detection rule in an enterprise environment:

• Scenario: Enterprise Endpoint Detection and Response (EDR) agents (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performing scheduled telemetry uploads to a cloud SIEM.

  • Context: The EDR agent initiates outbound HTTPS connections to the vendor’s ingestion endpoints, which may match the PureLogs Stealer IOCs if they share similar IP ranges or domain patterns used in the threat intelligence feed.
  • Filter/Exclusion: Exclude traffic where the Process Name matches known security agents (e.g., FalconSensor.exe, MsMpEng.exe) and the destination port is restricted to standard telemetry ports (443, 9001-9005).

• Scenario: Automated backup jobs utilizing third-party cloud storage providers (e.g., Veeam Backup & Replication or Rubrik) connecting to their management gateways.

  • Context: Scheduled nightly backup tasks often establish persistent connections to vendor-specific API endpoints that might overlap with the PureLogs Stealer’s known infrastructure, triggering alerts during peak backup windows.
  • Filter/Exclusion: Create a rule exclusion for source processes matching VeeamService.exe or rubrik-agent.exe running under the context of specific scheduled tasks (e.g., Task Name containing “Backup” or “Replication”) between 01:00 and 05:00 local time.

• Scenario: IT Admins utilizing remote management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti for software deployment and patching.

  • Context: During large-scale patch deployments, the SCCM client service (ccmexec.exe) communicates with distribution points that may share IP addresses or domain suffix