ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets the presence of 14 known IOCs associated with the Remus threat actor, indicating potential compromise or reconnaissance activity within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify and isolate affected assets before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Remus Total IOCs: 14 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://outfdue.click:5713/articles", "http://jxewele.shop:4262/tasks", "http://obutdor.shop:5003/workspaces", "http://petcarv.click:8239/documents", "http://petcarv.click:8239/collections", "http://jxewele.shop:4262/webhooks", "http://vgfeden.shop:7728/settings", "http://petcarv.click:8239/folders", "http://jxewele.shop:4262/users", "http://vgfeden.shop:7728/posts", "http://obutdor.shop:5003/articles", "http://jxewele.shop:4262/files", "http://vgfeden.shop:7728/payments", "http://alutove.shop:5627/webhooks"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: A network operations center (NOC) engineer uses Wireshark or tcpdump to capture traffic on a specific VLAN for troubleshooting latency issues, inadvertently matching a Remus IOCs hash or IP range if the capture file is stored in a shared folder or scanned by EDR.
  • Filter/Exclusion: Exclude processes named wireshark.exe, tcpdump, or tshark when the parent process is a terminal emulator (e.g., cmd.exe, powershell.exe) and the file path contains captures or pcap.
• Scenario: An IT administrator deploys a new version of Sysinternals tools (specifically PsExec or Process Monitor) to a jump server for remote troubleshooting, and the binary’s SHA256 hash matches one of the 14 Remus IOCs due to a known collision or outdated IOC list.
  • Filter/Exclusion: Exclude files located in the C:\Sysinternals\ directory or signed by Microsoft Corporation with a product name containing “Sysinternals” if the hash matches a known-good baseline.
• Scenario: A scheduled PowerShell job runs Get-ChildItem with -Recurse on a large data lake folder to generate an inventory report, and the resulting temporary cache file or log entry contains a string matching a Remus IOC (e.g., a specific URL or IP) used in a documentation snippet.
  • Filter/Exclusion: Exclude events where the parent process is powershell.exe and the command line contains Get-ChildItem and -Recurse, provided the user account belongs to the IT-Inventory group.
• Scenario: A developer tests a new API integration using Postman or curl against a staging environment, and the response body