ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Remus threat actor by monitoring three specific Indicators of Compromise (IOCs) within Azure Sentinel. Proactively hunting for these signals is critical because early identification of Remus-related artifacts enables the SOC team to rapidly isolate compromised assets and mitigate potential data exfiltration before lateral expansion occurs.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["147.79.67.186"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["147.79.67.186"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://steadsp.click:8321/images", "http://shhsift.click:7647/posts"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remus IOCs detection rule in an enterprise environment:

• Endpoint Protection Policy Updates via Scheduled Tasks

  • Scenario: The organization’s central management server (e.g., Microsoft Endpoint Configuration Manager or CrowdStrike Falcon) automatically pushes updated threat intelligence feeds to endpoints. This process often triggers the specific Remus IOCs as part of a nightly scheduled task that downloads and validates new signature definitions, mimicking the behavior of an active threat scan.
  • Filter/Exclusion: Exclude alerts where the source process is ccmexec.exe (SCCM) or falcon.sys (CrowdStrike) running under a scheduled task context (e.g., Task Name: "ThreatIntelUpdate"), and restrict the filter to business hours (08:00–18:00) on weekdays.

• IT Security Team Manual Threat Hunting Sessions

  • Scenario: During routine security operations, analysts manually execute the Remus hunting package or run specific IOC validation scripts against a subset of critical servers to verify detection efficacy. These manual executions generate logs identical to an actual threat detection event but originate from known administrative accounts (e.g., DOMAIN\sec-admin-01) rather than standard user workstations.
  • Filter/Exclusion: Create a rule exclusion for events where the User Account belongs to the “Security_Ops” or “IT_Admin” Active Directory groups, and the execution path matches known hunting script locations (e.g., C:\Program Files\ThreatHunting\Scripts\).

• Third-Party Backup and Archive Solutions

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize the Remus framework to scan archived data for known malware signatures before archiving. The backup agent processes