ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Remus threat actor by monitoring specific Indicators of Compromise (IOCs) known to be utilized in their attack campaigns. Proactively hunting for these IOCs within Azure Sentinel is critical due to the high severity of potential breaches, enabling the SOC team to rapidly detect and isolate early-stage intrusions before they escalate into significant incidents.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://neortal.click:8321/customers", "http://bestals.shop:8592/categories"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are the documented false positive scenarios for the ThreatFox: Remus IOCs detection rule, including specific enterprise contexts and recommended filtering strategies:

• Scenario 1: Scheduled Backup Verification by Veeam or Commvault

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Dell EMC NetBackup often utilize the “Remus” naming convention for their remote replication agents or specific IOCs (Indicators of Compromise) related to cloud synchronization. During nightly maintenance windows, these tools generate network traffic and file hashes that match the Remus signature.
  • Filter/Exclusion: Create a whitelist rule excluding alerts where the Process_Name contains “Veeam” or “NetBackup” AND the Source_IP belongs to the designated Backup Server subnet (e.g., 10.50.20.0/24).

• Scenario 2: Administrative Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: When IT administrators deploy security updates or specific agent configurations using SCCM, the deployment engine may instantiate a temporary process named “Remus” to handle remote management tasks. This is common during large-scale patching cycles where the system scans for known IOCs before applying changes.
  • Filter/Exclusion: Exclude events where the User_Account matches the service account used by SCCM (e.g., DOMAIN\SCCM_Service) and the Parent_Process_Name is “ccmsetup.exe” or “SMS_EXECUTIVE”.

• Scenario 3: Automated Threat Intelligence Feed Ingestion by Splunk or Elastic SIEM

  • Context: The organization’s internal threat intelligence platform (such as Splunk Enterprise Security or Elastic Stack) periodically ingests external feeds. If the Remus feed is part of the standard ingestion pipeline, the SIEM engine itself may trigger this