ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known PureLogs Stealer indicators to detect credential theft and data exfiltration attempts within the environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised assets before sensitive information is fully extracted by this high-severity threat actor.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["38.49.217.221", "64.44.131.64", "67.21.33.92"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.49.217.221", "64.44.131.64", "67.21.33.92"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: PureLogs Stealer IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Scanning of Quarantined Archives

  • Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the C:\Quarantine directory. During this process, the scanner extracts and analyzes a previously quarantined .zip archive containing legacy documentation that happens to include a file hash matching one of the PureLogs Stealer IOCs (likely an old, benign version of a utility tool).
  • Filter/Exclusion: Exclude detection events where the Process Name is the EDR scanner executable (e.g., csagent.exe, MsMpEng.exe) and the File Path contains keywords like _Quarantine_, Temp, or Staging.

• Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team deploys a new version of a third-party utility (e.g., a specific PDF converter or log viewer) using Microsoft Endpoint Configuration Manager (SCCM). The deployment package includes an installer (setup.exe) that extracts a dependency library matching the PureLogs IOCs into C:\Program Files\Common Files\ThirdParty. This triggers the rule during the initial rollout to 50+ workstations.
  • Filter/Exclusion: Create an exclusion for processes launched by deployment agents (e.g., ccmexec.exe, IntuneManagementExtension.exe) where the Parent Process is a known system management tool and the destination path is within standard application directories (C:\Program Files\*).

• Automated Backup Verification Jobs

  • Scenario: A nightly scheduled task (Task Scheduler)