ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by monitoring for specific Indicators of Compromise (IOCs) linked to the Remus threat actor within Azure Sentinel logs. Proactive hunting is essential because early identification of these high-severity IOCs enables the SOC team to rapidly isolate affected assets and mitigate potential lateral movement before the adversary establishes a persistent foothold in the environment.

IOC Summary

Malware Family: Remus Total IOCs: 8 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://zakuiru.shop:9048/tokens", "http://kupzovo.shop:7567/tags", "http://vexdico.shop:8539/videos", "http://kupzovo.shop:7567/payments", "http://zakuiru.shop:9048/messages", "http://none/comments", "http://zakuiru.shop:9048/reviews", "http://xightne.click:7242/categories"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Endpoint Security Scans

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) often perform daily deep scans that generate network traffic matching Remus IOCs. These agents may download definition updates or scan signatures from the same cloud infrastructure used by Remus, triggering a match on specific IP addresses or hash values.
  • Filter/Exclusion: Create an exclusion rule to ignore alerts where the Process Name matches known security agents (e.g., FalconSensor.exe, SentinelOne.exe) and the User Account is a local system account (NT AUTHORITY\SYSTEM). Additionally, exclude traffic originating from the specific subnet range dedicated to security management servers.

• Scenario: Automated Patch Management Deployment

  • Context: During weekly maintenance windows, tools like Microsoft Endpoint Configuration Manager (MECM) or Jamf Pro push updates across the fleet. The deployment server often communicates with external repositories that share DNS names or IP ranges associated with the Remus IOCs, causing legitimate patch download traffic to be flagged as suspicious activity.
  • Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 02:00 and 04:00 UTC on Tuesdays and Thursdays (typical maintenance windows). Alternatively, filter out events where the Source IP belongs to the internal Patch Management Server group and the Destination Port is standard HTTPS (443) or HTTP (80), excluding non-standard ports used by Remus.

• Scenario: Cloud Backup and Archiving Jobs

  • Context: Enterprise backup solutions such