ThreatFox: Remus IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively leveraging specific Indicators of Compromise (IOCs) from the Remus threat intelligence feed to establish persistence or execute lateral movement within Azure environments. The SOC team should proactively hunt for these indicators in Azure Sentinel because their high severity suggests an imminent risk of undetected compromise, necessitating immediate validation against current network traffic and endpoint logs to prevent potential data exfiltration.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remus
let malicious_domains = dynamic(["zelpx.garden"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://syntaxj.top:6278"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Remus IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint (MDE)

  • Scenario: The MDE management console pushes a scheduled policy update or definition refresh to the fleet. This process triggers the execution of mpcmdrun.exe or MsMpEng.exe, which downloads and validates threat intelligence feeds that include Remus-related signatures, causing the host to generate network traffic matching the Remus IOCs (specifically DNS queries to known reputation servers).
  • Filter/Exclusion: Exclude processes where the parent process is MsMpEng.exe or mpcmdrun.exe and the command line contains arguments related to “update” or “definition”. Additionally, filter by the specific user context of the local system account (NT AUTHORITY\SYSTEM) running during standard maintenance windows.

• Automated Vulnerability Scanning with Qualys Cloud Agent

  • Scenario: The Qualys Cloud Agent runs a scheduled vulnerability assessment job. During the scan, the agent queries external threat intelligence APIs to correlate asset data with known indicators. If the Remus IOC list includes specific IP ranges or domains used by major cloud providers (e.g., Azure, AWS) that host scanning infrastructure, the agent’s outbound connections will trigger the rule.
  • Filter/Exclusion: Create an exclusion for the Qualys agent executable (qualys_daemon.exe or qagent.exe) when communicating with known internal scan controller IPs. Alternatively, add a filter to ignore traffic originating from the “Qualys” application category in the firewall logs during the defined maintenance window (e.g., 02:00 – 04:00 UTC).

• Software Deployment via Microsoft SCCM/MECM

  ---