ThreatFox: PureLogs Stealer IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known PureLogs Stealer indicators to identify active credential and data exfiltration campaigns within the environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this stealer can prevent significant identity compromise before lateral movement occurs across cloud resources.

IOC Summary

Malware Family: PureLogs Stealer Total IOCs: 3 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - PureLogs Stealer
let malicious_ips = dynamic(["173.231.53.193", "216.250.250.88"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["173.231.53.193", "216.250.250.88"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - PureLogs Stealer
let malicious_domains = dynamic(["benbeloorg.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — PureLogs Stealer

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: PureLogs Stealer IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Agent Telemetry Updates

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a scheduled signature and IOC database update. This process often downloads and executes files that match the PureLogs Stealer hash signatures or network indicators as part of its own threat intelligence feed synchronization.
  • Filter/Exclusion: Exclude events where the Process Name matches known security agents (e.g., csagent.exe, MsMpEng.exe, SentinelOneAgent.exe) and the Parent Process is the specific update service or scheduler associated with that vendor.

• IT Asset Management & Software Inventory Scans

  • Scenario: Automated asset management tools like LANDesk (Ivanti), SCCM (Microsoft Endpoint Configuration Manager), or SolarWinds RMM run scheduled inventory scans. These agents frequently download and execute temporary installation packages or scanning scripts that may contain file hashes identical to the PureLogs Stealer IOCs, particularly if the enterprise uses a shared software repository containing these specific binaries.
  • Filter/Exclusion: Create an exclusion for User Account names belonging to service accounts (e.g., svc-asset-scan, SCCM-Agent) and restrict alerts to non-business hours or specific scheduled job windows defined in the task scheduler.

• Third-Party Patch Management Deployments

  • Scenario: During a monthly patch cycle, tools like Ivantage, ManageEngine Patch Manager, or WSUS (Windows Server Update Services) deploy critical updates to workstations. The deployment agent may download and stage installer files that trigger the PureLogs Stealer