ThreatFox: Remus IOCs

Hunt Hypothesis

This rule detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Remus threat actor, signaling potential reconnaissance or initial access attempts within the Azure Sentinel environment. Proactively hunting for these IOCs allows the SOC team to identify early-stage threats and mitigate risks before adversaries can establish persistence or expand their foothold in the network.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remus
let malicious_domains = dynamic(["texchub.biz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://texchub.biz:6520"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remus IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Antivirus or EDR Definition Updates

  • Context: Enterprise endpoints running tools like Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne often trigger the “Remus” IOC during their nightly automated definition update cycles. The security agent connects to a cloud repository that shares infrastructure with the Remus threat intelligence feed, causing a match on network traffic or process execution logs.
  • Suggested Filter: Create an exclusion based on the specific Process Name (e.g., MsMpEng.exe, FalconSensorService) and restrict the rule to trigger only when the source IP is not within the known corporate update server subnet range.

• Scenario: Third-Party Backup Agent Connectivity

  • Context: Enterprise backup solutions such as Veeam Backup & Replication, Rubrik, or Commvault frequently utilize cloud-based management consoles that communicate with external threat intelligence APIs. During the “Remus” IOCs scan, these agents may generate network sessions or file hashes that mimic the Remus signature while syncing metadata to their SaaS dashboard.
  • Suggested Filter: Implement a filter excluding traffic originating from specific Service Accounts (e.g., svc-veeam-agent, rubrik-backup) and limit detection to exclude connections destined for known backup vendor IP ranges listed in the enterprise allow-list.

• Scenario: Automated Compliance Scanning Jobs

  • Context: Scheduled compliance tools like Qualys, Tenable Nessus, or Tripwire perform regular vulnerability assessments that involve downloading threat feeds and scanning file systems. These jobs often execute scripts that query external intelligence sources, inadvertently triggering the Remus IOC match when the