ThreatFox: Remus IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging known Remus malware indicators to establish persistence and exfiltrate sensitive data within our Azure environment. Proactive hunting is critical because these specific IOCs represent a high-severity threat vector that may bypass standard automated alerts, requiring manual correlation to detect early-stage compromise before lateral expansion occurs.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remus
let malicious_domains = dynamic(["leafot.xyz", "sweetvp.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint (MDE)

  • Scenario: The MDE management console pushes a scheduled policy update that includes the latest definition of the “Remus” threat family. This triggers a background scan on workstations where legitimate administrative agents (e.g., MsMpEng.exe or SenseClient.exe) download and validate IOCs matching the Remus signature, generating alerts despite no malicious activity occurring.
  • Filter/Exclusion: Exclude events originating from known Endpoint Protection service accounts (e.g., NT AUTHORITY\SYSTEM, Local Service) where the process path matches the standard installation directory of the EDR agent and the event type is “Policy Update” or “Definition Download.”

• Automated Vulnerability Scanning with Tenable Nessus

  • Scenario: A nightly scheduled job runs a vulnerability assessment using Tenable Nessus. The scanner probes internal assets to check for known indicators associated with the Remus campaign, specifically querying file hashes and registry keys against its local IOC database. This legitimate scanning activity triggers the detection rule as it mimics the behavior of an active threat hunting process.
  • Filter/Exclusion: Create a filter to suppress alerts where the source IP belongs to the dedicated vulnerability management subnet (e.g., 10.x.x.0/24) and the user agent or process name contains “Tenable” or “Nessus,” provided no subsequent high-severity findings are reported for that specific scan session.

• Software Deployment via SCCM (Microsoft Endpoint Configuration Manager)

  • Scenario: The IT operations team executes a scheduled deployment of a security patch package using System Center Configuration Manager (SCCM). During the