ThreatFox: Remus IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the Remus threat actor, which may indicate an active intrusion or persistent foothold within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://teculse.click:9210/teams", "http://gyadazs.shop:5627/collections", "http://srtylab.shop:8213/articles"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: A security operations team deploys the Remus threat intelligence feed via a SIEM integration (e.g., Splunk or Elastic) and uses a script to automatically create static exclusion rules or update blocklists in the firewall/EDR. This process often involves writing IOC hashes or IPs to configuration files or databases, which may match the “Remus” IOCs if the feed itself contains those specific indicators as part of its metadata or test data.

  • Filter/Exclusion: Exclude events where the source process is a known SIEM agent or configuration management tool (e.g., ansible-playbook, chef-client, puppet-agent) and the destination path is within the SIEM’s local configuration directory (e.g., /etc/splunk/, C:\Program Files\Splunk\).

• Scenario: An enterprise IT department runs a scheduled vulnerability scan using tools like Nessus or Qualys that includes a custom plugin or script to validate against the “Remus” threat profile. The scanner may generate log entries or temporary files containing the specific IOCs (IPs, domains, or hashes) as part of its reporting or validation output.

  • Filter/Exclusion: Exclude events where the source process is a recognized vulnerability scanner (e.g., nessusd, qualys-agent, tenable.io) and the event type is “file write” or “log entry” to a temporary or report directory (e.g., /tmp/, C:\ProgramData\Nessus\).

• Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins, GitLab CI) to build and test a security library that includes unit tests for the “Remus” IOC matching logic. These tests often involve creating temporary files or memory allocations that contain the specific IOCs to verify detection accuracy, which can be picked up by file