ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Remus threat actor by monitoring three specific indicators of compromise (IOCs) within Azure Sentinel logs. Proactively hunting for these signals is critical because early identification of Remus-associated behaviors allows the SOC team to rapidly isolate affected assets and mitigate potential data exfiltration or lateral movement before broader impact occurs.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://beljaro.shop:2536/profiles", "http://beljaro.shop:2536/categories", "http://beljaro.shop:2536/products"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise EDR agents (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) often perform scheduled daily scans that generate network traffic matching Remus IOCs. The scan engine may download definition updates or telemetry data from a cloud endpoint that shares an IP range with the Remus infrastructure, triggering the hunt package.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name of the EDR agent (e.g., MsMpEng.exe or FalconSensorService.exe) and restrict the alert to non-business hours if the scan is known to run at 02:00 UTC. Alternatively, exclude traffic originating from the specific internal subnet where the EDR management server resides.

• Scenario: Admin-Initiated Security Tool Deployment

  • Context: System administrators frequently use deployment tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ansible Tower to push security configurations or new agent versions. During these deployments, the tools may establish connections to the Remus cloud for validation or license verification, mimicking the IOCs detected by the rule.
  • Filter/Exclusion: Implement a filter that excludes events where the Parent Process is ccmsetup.exe (SCCM) or ansible-playbook. Additionally, add an exclusion for specific Service Accounts used for deployment (e.g., DOMAIN\DeploySvc) to prevent alerts during known maintenance windows.

• Scenario: Automated Backup and Archive Jobs

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Commvault often utilize cloud repositories that may