ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Remus malware to exfiltrate credentials and sensitive data following a phishing campaign that delivers malicious payloads via infected URLs. Proactive hunting in Azure Sentinel is critical to detect anomalous outbound traffic to these specific indicators, identify lateral movement patterns, and confirm evidence of credential dumping before significant data loss occurs.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://gofkaxz.click:8137/transactions", "http://tokjoza.shop:5200/posts", "http://broadswordcallingdannyboy.com:4219"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

False Positive Scenarios: ThreatFox: Remus IOCs

• Legitimate Phishing Simulation Campaigns

  • Scenario: The enterprise security team runs monthly phishing simulations using a platform like KnowBe4 or Proofpoint. These campaigns distribute emails with safe, tracking URLs that mimic the structure of malicious links. When users click these links to complete training modules, the outbound traffic matches the Remus detection logic for “unusual outbound traffic to listed URLs,” triggering a false alert.
  • Suggested Filter/Exclusion: Create an exclusion rule in the SIEM or EDR platform that whitelists the specific domain ranges and IP addresses used by the simulation vendor (e.g., *.knowbe4.com, *.proofpoint.com). Additionally, filter out alerts where the user agent string contains “PhishingSim” or matches known internal training campaign IDs.

• Scheduled Backup and Exfiltration Jobs

  • Scenario: Automated backup agents such as Veeam, Rubrik, or Commvault are configured to run nightly jobs that exfiltrate large datasets to cloud storage or off-site repositories. These jobs generate significant outbound traffic patterns involving credential usage and data transfer, which can be misinterpreted by the rule as “signs of credential dumping or exfiltration” typical of Remus malware behavior.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00–06:00 local time) for hosts running these specific backup agents. Furthermore, add an exclusion based on the process name and hash; if the initiating process is VeeamAgent.exe or rbd.exe with a known good SHA-256 hash, suppress the alert regardless of traffic volume.

• Admin-Led Cloud Migration or Data Sync Tasks

  • **Scenario