ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by network connections to known Remus threat indicators, which often signify early-stage reconnaissance or command-and-control activity within the environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical because it enables the SOC team to identify and isolate potential compromises before they escalate into full-blown incidents.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remus
let malicious_domains = dynamic(["lawofi.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://lawofi.xyz:7538"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Remus IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Policy Updates via CrowdStrike Falcon

  • Scenario: The security team pushes a scheduled policy update to all Windows endpoints using CrowdStrike Falcon. This process triggers the falcon-sensor.exe service to download threat intelligence feeds (including IOCs) from the cloud, which matches the Remus IOC signatures in the detection logic due to overlapping hash values or network destination IPs.
  • Filter/Exclusion: Exclude traffic originating from the CrowdStrike Falcon sensor process (falcon-sensor.exe) where the source IP belongs to the internal management subnet (e.g., 10.20.50.0/24). Additionally, filter out events occurring during the defined maintenance window (e.g., Sundays 02:00–04:00 UTC).

• Automated Vulnerability Scanning with Tenable Nessus

  • Scenario: A scheduled weekly vulnerability scan is executed by a Tenable Nessus agent on critical file servers. During the “Agent Communication” phase, the scanner establishes outbound connections to external threat intelligence repositories to validate plugin versions and IOCs, inadvertently triggering the Remus detection rule due to shared IP reputation lists.
  • Filter/Exclusion: Create an exclusion for the tenable-agent.exe process communicating with known Tenable cloud endpoints (e.g., *.cloud.tenable.com). Ensure the filter specifically targets traffic initiated by the scheduled job ID associated with the “Weekly Critical Scan” task.

• Software Deployment via Microsoft SCCM/MECM

  • Scenario: The IT Operations team deploys a new patch for Adobe Acrobat using Microsoft Endpoint Configuration Manager (SCCM). The deployment agent (ccmexec.exe) downloads installation packages