URLhaus: PureLogsStealer Malicious URLs

Hunt Hypothesis

This hypothesis targets the execution of the PureLogsStealer infostealer, which typically operates via malicious URLs to exfiltrate sensitive data such as browser credentials and session tokens. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or web traffic patterns before the malware can establish persistence or escalate privileges within the environment.

IOC Summary

Threat: PureLogsStealer Total URLs: 2 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: PureLogsStealer
let malicious_domains = dynamic(["res.cloudinary.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["res.cloudinary.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer is manually testing a new internal microservice endpoint that shares a similar domain structure or path with the known PureLogsStealer URL (e.g., https://api.internal.corp.com/v1/logs vs. the malicious https://api.internal.corp.com/v1/logs/steal). The browser or API client generates a request to the legitimate internal service, triggering the URL match.

  • Filter/Exclusion: Exclude URLs where the Host header matches internal corporate DNS zones (e.g., *.corp.com, *.internal.net) or where the User-Agent header contains specific internal tool identifiers (e.g., Postman, curl/7.88.0, Python-urllib).

• Scenario: A security team is running a scheduled vulnerability scan or web crawler (e.g., using OWASP ZAP or Burp Suite) against the production environment to verify that the PureLogsStealer URL is properly blocked or redirected. The scanner explicitly requests the known malicious URL to confirm the WAF or reverse proxy behavior.

  • Filter/Exclusion: Exclude events where the source IP address belongs to the Security Operations or QA testing subnets (e.g., 10.20.5.0/24) and the User-Agent contains ZAP, Burp, or Nuclei.

• Scenario: An application monitoring agent (e.g., Datadog, New Relic, or AppDynamics) is configured to capture all HTTP requests for APM (Application Performance Monitoring) purposes. If the application has a cached or hardcoded reference to the PureLogsStealer URL in its configuration or logs, the agent may report this URL as part of a legitimate trace or error log entry.

  • Filter/Exclusion: Exclude events where the source process is a known APM agent binary (e.g