ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets the presence of specific Indicators of Compromise (IOCs) linked to the Remus threat actor, which often signal active reconnaissance or initial access attempts within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate potential intrusions early, reducing the dwell time of adversaries who leverage known artifacts to establish a foothold.

IOC Summary

Malware Family: Remus Total IOCs: 10 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://fuarnpp.shop:5627/files", "http://kipthen.shop:9932/reviews", "http://fuarnpp.shop:5627/workspaces", "http://kipthen.shop:9932/categories", "http://homecor.click:6527/projects", "http://trencts.shop:8592/images", "http://smaring.shop:9895/articles", "http://fuarnpp.shop:5627/tasks", "http://kipthen.shop:9932/events", "http://teculse.click:9210/payments"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: A DevOps team deploys a new version of a containerized application that includes a shared library or binary with a hash matching one of the Remus IOCs due to a common upstream dependency or build artifact reuse.
  • Filter/Exclusion: Exclude alerts where the process path resides within known application directories (e.g., /opt/app/, C:\Program Files\MyApp\) and the parent process is a recognized service manager (e.g., systemd, dockerd, kubernetes).
• Scenario: An IT administrator runs a standard vulnerability scanner or integrity checker (e.g., clamscan, trivy, or a custom PowerShell script) that loads or hashes files against a known IOC database, causing the scanner process itself or the files it inspects to match the Remus IOCs.
  • Filter/Exclusion: Exclude events where the parent process is a known security tool (e.g., clamscan.exe, trivy, powershell.exe with specific arguments like -ScriptName audit.ps1) or where the file path is located in a temporary scan directory (e.g., /tmp/scan/, C:\Temp\audit\).
• Scenario: A legacy line-of-business application uses a static DLL or executable that was compiled years ago and happens to share a hash with one of the Remus IOCs because it was built from the same source code or linker version as the malware sample.
  • Filter/Exclusion: Maintain a whitelist of specific file paths for known legacy applications (e.g., C:\LegacyApp\bin\helper.dll) and exclude alerts for these specific paths if the parent process is the legacy application’s main executable.
• Scenario: A scheduled backup or snapshot job (e.g., using rsync, robocopy, or Veeam) copies a