ThreatFox: Remus IOCs

Hunt Hypothesis

This hypothesis detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Remus threat actor, which may signal early-stage reconnaissance or lateral movement within the environment. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and contain potential intrusions before they escalate into broader compromises.

IOC Summary

Malware Family: Remus Total IOCs: 4 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://opeaadn.click:2993", "http://resghjs.click:7647", "http://dafkov.shop:6843", "http://citife.top:2930"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remus IOCs detection rule:

• Scenario: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) performs a scheduled daily definition update, which triggers a network connection to a Remus-managed cloud repository.

  • Filter/Exclusion: Create an exclusion based on the specific process name of the update agent (e.g., FalconService.exe or MsMpEng.exe) and restrict the rule trigger to only fire if the destination IP is not within the known internal range of the security vendor’s update servers.

• Scenario: A DevOps team executes a nightly CI/CD pipeline using Jenkins or GitLab Runners that pulls dependencies from a private artifact repository hosted on a Remus infrastructure node, generating traffic matching the IOCs.

  • Filter/Exclusion: Exclude alerts where the source process is identified as java.exe (Jenkins) or gitlab-runner.exe and the destination port matches standard artifact registry ports (e.g., 443, 8081), specifically during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: The IT Operations team runs a scheduled PowerShell script (Update-RemusConfig.ps1) to synchronize configuration data between on-premise Active Directory and the Remus cloud management console.

  • Filter/Exclusion: Implement a filter that suppresses alerts for powershell.exe processes launched by a specific, trusted service account (e.g., DOMAIN\svc-remus-sync) and verify that the command line arguments contain keywords like “sync” or “config”.

• Scenario: A third-party backup solution (such as Veeam Backup & Replication) initiates a replication job to a Remus-man