ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets the presence of specific indicators of compromise associated with the Remus threat actor, which may signal an active intrusion or persistent foothold within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.

IOC Summary

Malware Family: Remus Total IOCs: 4 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["51.195.111.253"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["51.195.111.253"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://smaring.shop:9895/exports", "http://trencts.shop:8592/documents", "http://clouven.click:8527/articles"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: A DevOps team deploys a new containerized microservice using a base image that includes a legacy version of the remus utility (or a similarly named internal tool) for database replication testing. The IOC matches the specific hash or path of this legitimate binary.
  • Filter/Exclusion: Exclude processes where the parent process is dockerd or containerd-shim, or filter by image name if the container registry tag matches the known good version (e.g., myapp/remus:1.2.3).
• Scenario: An endpoint protection agent (e.g., CrowdStrike Falcon or SentinelOne) quarantines a file identified as a known false positive in the Remus family, leaving a residual file in the quarantine folder that matches the IOC path or hash.
  • Filter/Exclusion: Exclude paths containing \Quarantine\, \Isolation\, or \CrowdStrike\Quarantine\ depending on the EDR vendor in use.
• Scenario: A security team runs a manual threat hunt or validation script that intentionally drops a copy of the Remus IOC file to a temporary directory (%TEMP% or /tmp) to verify detection coverage before deploying the new rule.
  • Filter/Exclusion: Exclude files located in standard temporary directories (C:\Users\<user>\AppData\Local\Temp, /tmp, /var/tmp) if the file age is less than 24 hours and the parent process is a known admin tool like PowerShell.exe or bash.
• Scenario: A CI/CD pipeline (e.g., Jenkins or GitLab CI) downloads a build artifact or dependency package that contains a bundled version of the Remus library for testing purposes, placing it in the workspace directory.
  • Filter/Exclusion: Exclude paths under the CI/