ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior linked to the Remus threat actor by monitoring four specific indicators of compromise (IOCs) within Azure Sentinel logs. Proactive hunting is essential because these high-severity IOCs often represent early-stage lateral movement or command-and-control activity that may evade standard automated alerts, requiring manual investigation to prevent broader network infiltration.

IOC Summary

Malware Family: Remus Total IOCs: 4 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["195.35.37.15"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["195.35.37.15"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://fasnzect.click:4929/contacts", "http://kupzovo.shop:7567/collections", "http://fasnzect.click:4929/exports"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remus IOCs detection rule in an enterprise environment:

• Scheduled Endpoint Protection Updates via GPO

  • Scenario: The organization uses Microsoft Intune or Group Policy Objects (GPO) to push daily definition updates for CrowdStrike Falcon or SentinelOne agents. These updates often trigger network connections to Remus-associated intelligence feeds for signature verification, matching the rule’s IOCs.
  • Filter/Exclusion: Create a filter to exclude traffic originating from the specific Intune Management Server IP range or GPO update accounts (e.g., svc-intune-updates) during standard maintenance windows (02:00 – 04:00 UTC).

• Automated Threat Intelligence Feed Ingestion by SIEM

  • Scenario: The enterprise’s central SIEM (e.g., Splunk or Microsoft Sentinel) runs a scheduled Python script using the requests library to pull daily threat intelligence feeds from Remus. This automated job initiates outbound HTTPS connections that hit the detection logic.
  • Filter/Exclusion: Exclude processes running under the service account svc-siem-feeder and restrict the exclusion to specific ports (443) used by the ingestion script, ensuring only traffic matching the known feed URL pattern is ignored.

• Cloud Backup Verification Jobs

  • Scenario: The IT operations team utilizes Veeam Backup & Replication for daily cloud backups. During the verification phase, Veeam agents query external security repositories (including Remus) to validate the integrity of backup chains before archiving, generating network traffic that aligns with the IOCs.
  • Filter/Exclusion: Add an exclusion rule for the Veeam.Backup.Service process running on designated Backup Proxies, specifically filtering out connections where the destination