ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Remus threat family by monitoring for specific Indicators of Compromise (IOCs) that signal potential reconnaissance or initial access attempts. The SOC team should proactively hunt for these signals in Azure Sentinel to rapidly validate and contain early-stage intrusions before they escalate into broader lateral movements within the cloud environment.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remus
let malicious_domains = dynamic(["midpfv.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://tolail.xyz:7538"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Remus IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Scenario: The security operations team pushes a global policy update to deploy new definition signatures and engine updates across the fleet. This process triggers the MsMpEng.exe (Antimalware Service Executable) to download and execute files matching Remus IOCs from the official Microsoft Update servers, which are known sources for these specific indicators.
  • Suggested Filter: Exclude network connections where the destination IP belongs to the *.update.microsoft.com or *.go.microsoft.com domains, provided the source process is MsMpEng.exe and the user context is SYSTEM.

• Automated Patch Deployment via SCCM (System Center Configuration Manager)

  • Scenario: A scheduled nightly job runs on domain-joined workstations to install critical OS patches. The deployment agent (ccmexec.exe) extracts installation packages that include binaries flagged by the Remus IOCs, specifically during the extraction phase where temporary files are created in the C:\Windows\CCMCache directory before being executed by the Windows Installer service.
  • Suggested Filter: Create an exclusion for file creation events originating from ccmexec.exe or msiexec.exe within the C:\Windows\CCMCache and C:\Windows\SoftwareDistribution paths, restricted to the “System” user account during business hours (08:00–18:00).

• Third-Party Vulnerability Scanning with Qualys or Tenable Nessus

  • Scenario: The enterprise runs a scheduled vulnerability assessment using the Qualys Cloud Agent. During the scan, the agent (qualyspc.exe) downloads and