ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Remus threat actor by correlating seven specific Indicators of Compromise (IOCs) within Azure Sentinel logs. Proactive hunting for these signals is critical because early identification of Remus-associated artifacts enables rapid containment before the adversary establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: Remus Total IOCs: 7 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://bravplo.click:7713/workspaces", "http://kupzovo.shop:7567/reviews", "http://kupzovo.shop:7567/accounts", "http://shkpiva.shop:5627/tags", "http://mrlketo.shop:8932/exports", "http://kupzovo.shop:7567/tasks", "http://kupzovo.shop:7567/videos"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, along with targeted filters and exclusions:

• Scenario: Scheduled Malware Definition Updates via Microsoft Defender

  • Context: The enterprise runs a nightly scheduled task (Microsoft-Windows-Defender) that pulls definition updates from the cloud. If the update server or a specific hash of the updated engine matches one of the 7 Remus IOCs, it triggers an alert during the maintenance window (e.g., 02:00 AM).
  • Filter/Exclusion: Exclude alerts where the ProcessName is MpCmdRun.exe or MsMpEng.exe and the SourceIP belongs to the internal update distribution server range (e.g., 192.168.10.x). Additionally, suppress alerts occurring between 01:00 and 04:00 local time for this specific rule.

• Scenario: Automated Backup Scans by Veeam or Commvault

  • Context: Enterprise backup agents (e.g., Veeam.Backup.Service.exe or CommServe.exe) perform deep scans of file systems to ensure data integrity. These agents often utilize network signatures that overlap with the Remus IOCs when communicating with the central management server, generating high-volume noise during peak backup windows.
  • Filter/Exclusion: Create a filter excluding events where the ParentProcessName is Veeam.Backup.Service.exe, CommServe.exe, or BackupAgent.exe. Ensure the exclusion applies only when the destination port matches standard backup ports (e.g., 10000-10050) and the traffic direction is outbound to known backup infrastructure IPs.

• **Scenario: Endpoint Detection and Response (EDR) Telemetry Uploads