ThreatFox: Remus IOCs

Hunt Hypothesis

This detection identifies adversary activity by correlating six specific Indicators of Compromise (IOCs) linked to the Remus threat actor within Azure Sentinel logs. Proactive hunting for these signatures is critical to uncover early-stage reconnaissance or lateral movement that may evade standard signature-based alerts, allowing the SOC team to mitigate potential breaches before they escalate.

IOC Summary

Malware Family: Remus Total IOCs: 6 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["64.176.12.165"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.176.12.165"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://vexdico.shop:8539/profiles", "http://shkpiva.shop:5627/products", "http://mrlketo.shop:8932/projects", "http://vexdico.shop:8539/customers", "http://mrlketo.shop:8932/accounts"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: Remus IOCs detection rule:

• Scenario 1: Scheduled Endpoint Protection Updates

  • Context: The enterprise utilizes Microsoft Defender for Endpoint (MDE) or CrowdStrike Falcon. During nightly maintenance windows, these agents automatically download definition updates and threat intelligence feeds from the vendor’s cloud infrastructure. These downloads often match the specific IP addresses or domain hashes associated with the Remus IOC set due to shared CDN usage or overlapping network ranges.
  • Filter/Exclusion: Create a rule exclusion based on Process Name (MsMpEng.exe, FalconSensorService.exe) and User Context. Exclude alerts where the initiating user is a local system account (e.g., NT AUTHORITY\SYSTEM or LOCAL SERVICE) occurring between 01:00 and 05:00 UTC.

• Scenario 2: Third-Party Cloud Backup Synchronization

  • Context: The organization employs Veeam Backup & Replication or Rubrik for daily data synchronization to a cloud repository. These tools establish persistent connections to external storage nodes that may share the same ASN (Autonomous System Number) or IP blocks as the Remus threat indicators, triggering false alerts during large volume backup jobs.
  • Filter/Exclusion: Implement an exclusion based on Destination Port and Traffic Volume. Filter out alerts where the destination port is 443 or 8080 and the data transfer size exceeds 50MB within a 10-minute window, provided the source process is identified as vbr.exe (Veeam) or rubrik-agent.

• Scenario 3: Automated Patch Management Deployment

  • Context: The IT Operations team runs **Ansible Tower