ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating network and endpoint telemetry against eleven specific Indicators of Compromise (IOCs) linked to the Remus threat actor. A SOC team should proactively hunt for these signals in Azure Sentinel to identify early-stage intrusions that may evade standard signature-based detections, ensuring timely containment of this high-severity threat.

IOC Summary

Malware Family: Remus Total IOCs: 11 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://piarl.site:9048/categories", "http://flreaow.click:6527/files", "http://piarl.site:9048/messages", "http://gofkaxz.click:8137/sessions", "http://nopxs.shop:8839/users", "http://piarl.site:9048/profiles", "http://uiccvbk.click:8839/addresses", "http://flreaow.click:6527/tags", "http://piarl.site:9048/reviews", "http://luwerae.click:7748/articles", "http://piarl.site:9048/tasks"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remus IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Antivirus or EDR Definition Updates

  • Context: Enterprise endpoints running tools like CrowdStrike Falcon, Microsoft Defender for Endpoint (MDE), or Symantec Endpoint Protection often pull definition updates from central repositories. If the Remus IOCs include specific hash values or domain names used by these vendors’ update servers, the rule may trigger during nightly maintenance windows when agents download new signatures.
  • Suggested Filter: Exclude traffic originating from known internal update distribution points (e.g., WSUS servers) or filter based on the ProcessName of the EDR agent updater service (e.g., C:\Program Files\CrowdStrike\csagent.exe).

• Scenario: Admin-Initiated Security Baseline Scans

  • Context: During quarterly security audits, System Administrators often manually trigger deep scans using tools like Tenable Nessus, Qualys, or OpenVAS. These scanners frequently probe internal assets and may generate network connections to external threat intelligence feeds that match the Remus IOCs (e.g., specific IP ranges used for vulnerability reporting).
  • Suggested Filter: Create an exclusion based on UserAccount containing “Admin” or “Service” prefixes, combined with a time-window filter (e.g., exclude alerts occurring between 02:00 and 06:00 UTC) to capture scheduled maintenance jobs.

• Scenario: Cloud Backup and Synchronization Services

  • Context: Organizations utilizing cloud backup solutions like Veeam, Rubrik, or Microsoft Azure Backup often establish persistent connections to external storage gateways. If the Remus IOCs encompass IP addresses or domains used by these backup vendors