ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating Azure Sentinel logs against twelve specific Indicators of Compromise (IOCs) linked to the Remus threat actor. Proactive hunting for these signals is critical to identify early-stage intrusions and mitigate potential data exfiltration or lateral movement before they escalate into a full-scale incident.

IOC Summary

Malware Family: Remus Total IOCs: 12 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://doresxa.click:6271/transactions", "http://bestals.shop:8592/images", "http://neortal.click:8321/videos", "http://bestals.shop:8592/comments", "http://neortal.click:8321/accounts", "http://cdire.shop:9048/payments", "http://shhsift.click:7647/projects", "http://bestals.shop:8592/messages", "http://flreaow.click:6527/invoices", "http://neortal.click:8321/categories", "http://cdire.shop:9048/exports", "http://cdire.shop:9048/settings"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus/EDR Definition Updates via Remus-Integrated Agents

  • Context: Enterprise endpoints running EDR solutions (e.g., CrowdStrike Falcon or Microsoft Defender) often utilize the Remus feed to pull definition updates. The scheduled update job may trigger network connections to Remus IOCs that mimic threat behavior but are part of routine maintenance.
  • Filter/Exclusion: Exclude traffic where the source process is C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe (or equivalent EDR agent) and the destination port is restricted to standard update ports (e.g., 443, 80). Add a condition: Process Name IN ("FalconService", "MsMpEng.exe") AND Destination Port == 443.

• Scenario: Admin-Initiated Threat Intelligence Feed Synchronization

  • Context: Security Operations Center (SOC) administrators frequently run manual or scheduled PowerShell scripts to synchronize the local threat intelligence database with the Remus feed. These administrative tasks often generate high-volume network requests matching the 12 IOCs, appearing as suspicious outbound traffic from a management workstation.
  • Filter/Exclusion: Create an exclusion rule for user accounts belonging to the “Security Admins” group or specific jumpbox workstations (e.g., Hostname IN ("SOC-JUMP-01", "SOC-JUMP-02")). Additionally, filter out events where the initiating process is powershell.exe with a command line containing keywords like -ImportRemusFeed or -UpdateThreatIntel.

• Scenario: Third-Party SIEM Integration and Log Forwarding

  • **Context