ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by monitoring for eight specific Indicators of Compromise (IOCs) linked to the Remus threat actor within Azure Sentinel logs. Proactively hunting for these IOCs is critical because early identification of Remus-associated signals enables the SOC team to rapidly isolate affected assets and mitigate potential data exfiltration or lateral movement before full compromise occurs.

IOC Summary

Malware Family: Remus Total IOCs: 8 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["188.166.234.214"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["188.166.234.214"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://flreaow.click:6527/customers", "http://shhsift.click:7647/products", "http://cdire.shop:9048/files", "http://flreaow.click:6527/images", "http://mountat.click:7528/tokens", "http://shhsift.click:7647/customers", "http://cdire.shop:9048/contacts"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, along with targeted filtering strategies suitable for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoints running Microsoft Defender for Endpoint or Symantec Endpoint Protection often trigger scheduled jobs that download signature updates from the vendor’s cloud infrastructure. These update servers frequently utilize IP addresses and domains that overlap with the Remus IOCs, particularly if the Remus rule includes generic CDN ranges used by security vendors.
  • Filter/Exclusion: Create a whitelist exclusion based on specific Process Names (e.g., MpCmdRun.exe, SymantecDefender.exe) and restrict the alert to only trigger when these processes communicate with ports other than standard update ports (443, 80) or outside of defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Automated Cloud Backup Jobs

  • Context: Organizations utilizing cloud backup solutions like Veeam, Rubrik, or Acronis Cyber Protect often have scheduled jobs that connect to external S3 buckets or vendor gateways. The Remus IOCs may include IP ranges used by these storage providers, causing alerts when the backup agent initiates a connection during its nightly window.
  • Filter/Exclusion: Implement an exclusion rule targeting specific Service Accounts (e.g., svc_backup_prod, VeeamBackupSvc) and filter out traffic originating from designated Backup VLANs or subnets where these agents are deployed, ensuring the rule only alerts on user-facing workstations.

• Scenario: Third-Party Patch Management Execution

  • Context: Tools such as Ivanti Neurons, ManageEngine Endpoint Central,