ThreatFox: Remus IOCs

Hunt Hypothesis

This rule detects the presence of known Indicators of Compromise (IOCs) associated with the Remus threat actor, signaling potential unauthorized access or lateral movement within the environment. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify and contain active threats before they can escalate, leveraging high-severity intelligence to reduce dwell time and mitigate impact.

IOC Summary

Malware Family: Remus Total IOCs: 4 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["137.184.108.14"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["137.184.108.14"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://bestals.shop:8592/projects", "http://neortal.click:8321/folders", "http://bestals.shop:8592/subscriptions"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: A DevOps engineer uses Ansible or Terraform to provision a new Linux container or VM where the remus binary (or a similarly named utility for remote memory synchronization) is part of the standard image or installed via a package manager like apt/yum. The IOC might match the file path /usr/local/bin/remus or the specific hash if the tool is a known open-source component.

  • Filter/Exclusion: Exclude file paths under standard system directories (e.g., /usr/bin, /usr/local/bin, /opt/ansible/) or exclude processes spawned by ansible-playbook, terraform apply, or docker run if the parent process is a known CI/CD agent.

• Scenario: A security team performs a threat hunt or IOC validation by downloading the Remus sample or its components to an isolated test VM or a dedicated hunting lab. The detection rule triggers because the specific file hash or memory signature is present on the host, even though it is an intentional test.

  • Filter/Exclusion: Exclude hosts tagged with a custom AD attribute or GPO setting like HuntingLab=true, or exclude processes where the parent is powershell.exe or bash.exe and the command line contains keywords like -Test, -Validate, or -Hunt.

• Scenario: An application server runs a legacy Java or .NET application that bundles a native library or helper executable named remus.dll or remus.so for internal data replication tasks. This is a common naming convention for “remote” utilities in older enterprise software, leading to a hash or name match with the ThreatFox IOC.

  • Filter/Exclusion: Exclude file paths within application-specific directories (e.g., /opt/app/lib/, `C:\Program Files\LegacyApp\bin