ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets the presence of specific Indicators of Compromise (IOCs) linked to the Remus threat actor, indicating potential unauthorized access or data exfiltration attempts within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and contain active threats before they escalate, leveraging high-severity intelligence to reduce dwell time and mitigate the risk of persistent compromise.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://quiunch.click:6271/events", "http://quiunch.click:6271/files", "http://spiohop.shop:9932/categories"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a containerized application that includes a dependency on a library matching one of the Remus IOCs (e.g., a specific hash of a shared library or a known benign IP range used for internal service discovery).
  • Filter/Exclusion: Exclude alerts where the source process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner, dockerd) or where the parent process is a container runtime (containerd-shim, dockerd).
• Scenario: An internal monitoring agent (e.g., Datadog, New Relic, or Splunk Universal Forwarder) performs periodic health checks or log shipping to an endpoint that matches an IOC (such as a specific port or IP address associated with the Remus campaign, which might coincide with an internal DNS resolver or monitoring collector).
  • Filter/Exclusion: Exclude alerts where the destination IP or port matches the internal monitoring infrastructure (e.g., 10.0.5.10:8125 for StatsD or 10.0.5.11:4500 for New Relic) and the source process is a known monitoring agent binary.
• Scenario: A Windows Server scheduled task runs a maintenance script that downloads a patch or configuration file from an internal file share or repository (e.g., \\fileserver\patches\remus-lib.dll) where the file hash or URL matches an IOC due to a shared naming convention or reused artifact.
  • Filter/Exclusion: Exclude alerts where the source process is svchost.exe (specifically the Task Scheduler service) or cmd.exe/powershell.exe launched by a known scheduled task name (e.g., “DailyPatchCheck