ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by matching Azure Sentinel logs against nine specific Indicators of Compromise (IOCs) linked to the Remus threat actor. Proactively hunting for these signatures is critical because Remus employs sophisticated evasion tactics that often bypass standard perimeter defenses, requiring deep inspection of internal telemetry to prevent lateral movement and data exfiltration.

IOC Summary

Malware Family: Remus Total IOCs: 9 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["72.62.195.74"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["72.62.195.74"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://tokjoza.shop:5200/events", "http://shkpiva.shop:5627/posts", "http://mrlketo.shop:8932/categories", "http://vexdico.shop:8539/notifications", "http://shkpiva.shop:5627/teams", "http://vexdico.shop:8539/reports", "http://shkpiva.shop:5627/images", "http://mrlketo.shop:8932/workspaces"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Database Updates via Remus Endpoint

  • Context: The organization uses a centralized endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) that utilizes the “Remus” service account to push definition updates. This process triggers network connections and file integrity checks matching the 9 IOCs defined in the hunt package.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the specific Service Account name (e.g., svc-remus-updater) and restrict it to the known IP range of the update server cluster. Additionally, filter out events where the process path matches the standard installation directory: C:\Program Files\Remus\Updater\*.exe.

• Scenario: Admin-Led Patch Deployment Using SCCM/Intune

  • Context: During a monthly patching window, System Center Configuration Manager (SCCM) or Microsoft Intune deploys a specific security agent update. The deployment agent executes scripts that generate the exact IOCs associated with Remus as part of the installation handshake and registry modification tasks.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window corresponding to the maintenance schedule (e.g., Sundays 02:00–06:00 UTC). Alternatively, exclude events where the parent process is ccmsetup.exe or msiexec.exe and the user context is SYSTEM or a specific deployment group account like AD-Deploy-Patch.

• Scenario: Automated Backup Job Execution

  • Context: A nightly backup job managed by Veeam or Commvault runs under a service account named “Remus-Backup”. This job performs file