ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with the Remus threat actor, enabling the detection of potential footholds or lateral movement activities within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and contain high-severity threats before they can escalate into broader data exfiltration or ransomware deployment.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://booohop.shop:5627/tokens", "http://spiohop.shop:9932/posts", "http://nopxs.shop:8839/webhooks"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: A DevOps team uses the Remus CLI tool (a legitimate open-source project for database replication management) to set up cross-region database failover. The tool’s binary or associated configuration files match the hash or path-based IOCs in the ThreatFox feed.

  • Filter/Exclusion: Exclude processes originating from specific DevOps service accounts (e.g., svc-db-replication) or limit the detection to non-production environments. Alternatively, whitelist the specific SHA256 hash of the approved remus binary version used in the environment.

• Scenario: An IT administrator performs a manual disk cloning or backup operation using a utility named Remus (or a similar name variant) during a server migration or hardware refresh. The executable is placed in a temporary directory like C:\Temp\ or C:\Users\Admin\Downloads\, triggering path-based IOCs.

  • Filter/Exclusion: Exclude executions from known admin temporary directories (C:\Temp\, C:\Users\*\Downloads\) when the parent process is a known admin tool (e.g., PowerShell.exe, cmd.exe) and the user belongs to the Domain Admins or Server Admins group.

• Scenario: A security testing team runs a YARA scan or memory dump analysis using a script that references the string “Remus” (as part of a test case or mock malware signature) in a controlled test environment. The IOC matches the string-based rule even though no malicious activity is occurring.

  • Filter/Exclusion: Exclude detections where the process is running under a dedicated Security Test service account or within a designated test VLAN/subnet. Additionally, exclude if the parent process is a known security tool like yara.exe or volatility.exe.

• Scenario: A CI/CD pipeline job on