ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets the presence of specific indicators of compromise associated with the Remus threat actor, who leverages these IOCs to establish footholds or execute malicious payloads within the environment. Proactively hunting for these signatures in Azure Sentinel allows the SOC to identify potential intrusions early, mitigating the risk of lateral movement or data exfiltration before the adversary achieves their objectives.

IOC Summary

Malware Family: Remus Total IOCs: 10 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://tiruet.com:5632", "http://homecor.click:6527/articles", "http://kipthen.shop:9932/subscriptions", "http://fuarnpp.shop:5627/transactions", "http://clouven.click:8527/notifications", "http://smaring.shop:9895/attachments", "http://homecor.click:6527/users", "http://fuarnpp.shop:5627/sessions", "http://fuarnpp.shop:5627/payments", "http://tfoyses.shop:3452/exports"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Legacy Application Deployment via Group Policy: The Remus IOCs may include specific binary names or hash values associated with older, third-party enterprise software (e.g., legacy Java-based reporting tools or specific vendor agents like Splunk Universal Forwarder or Carbon Black agents) that are deployed across the estate via Group Policy Object (GPO) or Configuration Manager.
  • Filter/Exclusion: Exclude processes where the parent process is gpupdate.exe or ccmexec.exe (System Center Configuration Manager), or filter by known installation directories (e.g., C:\Program Files\VendorName\) and verified digital signatures from the specific vendor.
• Scheduled Maintenance Jobs for Log Rotation or Cleanup: Some IOCs might match scripts or executables used in standard IT maintenance tasks, such as PowerShell scripts or batch files named generically (e.g., cleanup.bat, rotate_logs.ps1) that are executed by scheduled tasks on file servers or database hosts to manage disk space.
  • Filter/Exclusion: Exclude executions where the parent process is schtasks.exe or Task Scheduler (taskschd.msc), and verify that the working directory is a standard maintenance path (e.g., C:\Admin\Scripts\ or C:\Maintenance\) rather than user profile directories.
• Development and QA Environments: In non-production environments, developers or QA engineers may run test builds, containerized applications, or debuggers that match the IOCs (e.g., a specific version of python.exe or a custom test binary) while testing integrations or security patches.
  • Filter/Exclusion: Exclude hosts tagged with Environment=Dev or Environment=QA in your asset inventory, or filter by user accounts belonging to the DevTeam or QA AD security groups, provided these environments are isolated from