ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with the Remus threat actor to identify potential unauthorized access or persistence mechanisms within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to detect and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.

IOC Summary

Malware Family: Remus Total IOCs: 7 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["45.77.68.157"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.77.68.157"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://teculse.click:9210/accounts", "http://spiohop.shop:9932/collections", "http://cruahop.shop:8213/profiles", "http://booohop.shop:5627/projects", "http://spiohop.shop:9932/settings", "http://booohop.shop:5627/articles"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Legacy Application Deployment via Group Policy: An IT administrator deploys a legacy line-of-business application (e.g., a specific version of SAP GUI or Oracle Client) that includes a DLL or executable matching one of the Remus IOCs (such as a known hash for svchost.exe or a specific path like C:\Program Files\Remus\).

  • Filter/Exclusion: Exclude alerts where the parent process is gpupdate.exe or svchost.exe (Group Policy service) and the file path resides under standard application directories like C:\Program Files\ or C:\Program Files (x86)\.

• Scheduled Maintenance Job for Third-Party Backup Software: A scheduled task (e.g., Veeam, Commvault, or Acronis) runs a maintenance script or agent component that matches a Remus IOC (e.g., a specific SHA256 hash for a backup agent binary).

  • Filter/Exclusion: Exclude alerts where the parent process is Task Scheduler (taskschd.msc or schtasks.exe) and the working directory or file path aligns with the vendor’s standard installation path (e.g., C:\Program Files\Veeam\ or C:\Program Files\Commvault\).

• Development Team Testing with Containerized Environments: Developers run containerized applications (Docker/Podman) that include a base image with a library or binary matching a Remus IOC (e.g., a specific version of libssl.so or a test executable).

  • Filter/Exclusion: Exclude alerts where the parent process is docker.exe, podman.exe, or containerd-shim and the file path resides within a container-specific directory (e.g., /var/lib/docker/ or /var/lib/containers/).