ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating three specific Indicators of Compromise (IOCs) linked to the Remus threat actor within Azure Sentinel logs. Proactive hunting for these IOCs is critical because early identification of Remus-associated signals allows the SOC team to rapidly contain potential intrusions before they escalate into broader data exfiltration or lateral movement incidents.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["64.227.109.19"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.227.109.19"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://mrlketo.shop:8932/users", "http://uiccvbk.click:8839/orders"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definitions Update via WSUS

  • Context: The endpoint protection suite (e.g., Microsoft Defender or CrowdStrike) is configured to pull definition updates from a local WSUS server. If the update package contains a hash matching one of the Remus IOCs, the rule triggers during the nightly maintenance window.
  • Filter/Exclusion: Create an exclusion based on the Process Name (MpCmdG.exe for Defender or csagent.exe for CrowdStrike) and restrict the alert to only fire if the process is not running under a scheduled task context (e.g., exclude Scheduled Task: {GUID-WSUS-Update}).

• Scenario: Admin Deployment of Security Baselines via SCCM/Intune

  • Context: System Administrators use Microsoft Endpoint Configuration Manager (SCCM) or Intune to push security baselines. During the deployment phase, a script executes a verification tool that downloads a configuration file containing one of the Remus IOCs from an internal artifact repository.
  • Filter/Exclusion: Exclude alerts where the Parent Process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the Source IP belongs to the internal management subnet (e.g., 10.50.x.x).

• Scenario: Internal Threat Intelligence Platform Synchronization

  • Context: The enterprise runs an internal threat intelligence platform (such as Tenable.io or a custom Splunk instance) that periodically syncs IOC feeds from external sources like VirusTotal or AlienVault OTX. This synchronization process may download and cache the specific Remus IOCs as part of its standard