URLhaus: RemusStealer Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where endpoints access known RemusStealer malicious URLs to exfiltrate sensitive credentials and browser data through web traffic channels. Proactively hunting for these specific indicators in Azure Sentinel is critical because early detection of this stealer allows the SOC team to isolate compromised assets before lateral movement occurs across the cloud environment.

IOC Summary

Threat: RemusStealer Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: RemusStealer
let malicious_domains = dynamic(["31.77.168.180"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["31.77.168.180"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: RemusStealer Malicious URLs rule in an enterprise environment, along with recommended filters or exclusions:

• Automated Software Update Scans by Endpoint Protection Agents

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently perform background integrity checks and definition updates. These agents often query the remus-stealer detection engine’s own update servers or third-party threat intelligence feeds that host the RemusStealer signature definitions. The traffic to these specific endpoints may be flagged as “RemusStealer” because the URL structure matches the known malicious patterns used for the initial discovery of the stealer, even though the connection is from a trusted security tool performing a routine health check.
  • Filter/Exclusion: Exclude outbound connections where the Source Host belongs to the Security-Tools or Endpoint-Protection asset group and the Destination URL contains keywords like /update, /definitions, or specific known update server domains (e.g., *.crowdstrike.com, *.microsoft.com).

• IT Administration via Remote Desktop Management Tools

  • Scenario: System administrators using remote management platforms (such as Ivanti Neurons, ManageEngine Desktop Central, or SCCM) often deploy patches or configuration scripts that require downloading temporary payloads. If an admin task involves distributing a security patch specifically targeting the RemusStealer threat family, the deployment server may pull resources from a URL that is currently tagged in the Hunt package. This legitimate administrative traffic mimics the behavior of the stealer attempting to download its payload, triggering the rule during scheduled maintenance windows (e.g., Tuesday 02:00 UTC).
  • Filter/Exclusion: Create an exclusion for traffic originating from Jump Hosts or Patch Management Servers during defined business hours or