This hypothesis targets the presence of 16 known Indicators of Compromise (IOCs) linked to the Remus threat actor, which may indicate active reconnaissance or initial access attempts within the environment. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC team to identify and contain potential intrusions before they escalate, leveraging high-severity threat intelligence to reduce dwell time.
Malware Family: Remus Total IOCs: 16 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://teechop.shop:8213/accounts | botnet_cc | 2026-09-13 | 75% |
| url | hxxp://gofkaxz.click:8137/tags | botnet_cc | 2026-09-13 | 75% |
| url | hxxp://trwehop.shop:5627/tags | botnet_cc | 2026-09-13 | 75% |
| url | hxxp://arqtsop.shop:9932/invoices | botnet_cc | 2026-09-13 | 75% |
| url | hxxp://trwehop.shop:5627/profiles | botnet_cc | 2026-09-13 | 75% |
| url | hxxp://teechop.shop:8213/reviews | botnet_cc | 2026-09-13 | 75% |
| url | hxxp://teculse.click:9210/notifications | botnet_cc | 2026-09-13 | 75% |
| url | hxxp://arqtsop.shop:9932/webhooks | botnet_cc | 2026-09-13 | 75% |
| url | hxxp://nopxs.shop:8839/contacts | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://coyxte.top:7688/contacts | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://teechop.shop:8213/imports | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://teculse.click:9210/contacts | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://arqtsop.shop:9932/contacts | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://trwehop.shop:5627/permissions | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://arqtsop.shop:9932/products | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://trwehop.shop:5627/webhooks | botnet_cc | 2026-09-12 | 75% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://teechop.shop:8213/accounts", "http://gofkaxz.click:8137/tags", "http://trwehop.shop:5627/tags", "http://arqtsop.shop:9932/invoices", "http://trwehop.shop:5627/profiles", "http://teechop.shop:8213/reviews", "http://teculse.click:9210/notifications", "http://arqtsop.shop:9932/webhooks", "http://nopxs.shop:8839/contacts", "http://coyxte.top:7688/contacts", "http://teechop.shop:8213/imports", "http://teculse.click:9210/contacts", "http://arqtsop.shop:9932/contacts", "http://trwehop.shop:5627/permissions", "http://arqtsop.shop:9932/products", "http://trwehop.shop:5627/webhooks"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses a standard CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a new microservice, where the build artifact or container image contains a known hash or URL from the Remus IOC list due to a shared open-source dependency or a legitimate third-party library that coincidentally matches an IOC.
jenkins.exe, docker.exe, kubectl.exe) or where the parent process is a build tool (e.g., msbuild.exe, gradle.bat). Additionally, whitelist specific container image digests or artifact paths if the IOC is a file hash.Scenario: An IT administrator performs a routine patch management task using a tool like SCCM (System Center Configuration Manager) or WSUS, where a downloaded update package or installer script contains a URL or file hash that matches one of the Remus IOCs because the vendor’s distribution server is using a domain or path that overlaps with the threat intelligence feed.
ccmsetup.exe, wuaexcl.exe) or where the network connection originates from a trusted internal IP range (e.g., 10.0.0.0/8) and the destination port is 80/443. Whitelist specific vendor domains if the IOC is a URL.Scenario: A security team runs a proactive threat hunt or validation script using a tool like Velociraptor or CrowdStrike Falcon to test detection coverage, where the script intentionally accesses a known IOC URL or file to verify that the detection rule fires correctly.