ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets the presence of specific Indicators of Compromise (IOCs) linked to the Remus threat actor, which may signal an active intrusion or persistent backdoor within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["75.148.178.13", "147.182.203.222"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["75.148.178.13", "147.182.203.222"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Legacy Application Dependency on Remus-Associated Binaries: An older internal line-of-business application (e.g., a custom Java-based inventory system) may bundle or dynamically load a shared library or helper executable that matches one of the Remus IOCs due to historical code reuse or third-party component integration.
  • Filter/Exclusion: Exclude the specific process path (e.g., C:\Apps\Inventory\bin\helper.dll) and its parent process (java.exe or the specific service name) if the binary hash matches a known good version used exclusively by that application.
• Scheduled Maintenance Job Using Remus-Linked Utility: A nightly scheduled task (e.g., via Windows Task Scheduler or cron) runs a data cleanup or log rotation script that invokes a utility binary associated with the Remus threat cluster for file compression or checksum verification.
  • Filter/Exclusion: Exclude the specific scheduled task name (e.g., Nightly_Log_Cleanup) and the associated user account (e.g., svc-maintenance) when the IOC is observed in the context of a scheduled job execution rather than interactive user activity.
• Development Environment Testing with Remus Samples: Developers in the QA or Security Engineering team may intentionally run or test against known Remus IOCs in isolated development containers or VMs to validate detection coverage or update threat intelligence feeds.
  • Filter/Exclusion: Exclude processes running within specific development container images (e.g., Docker container dev-remus-test) or on designated jump hosts/VMs tagged with env=dev or purpose=iotesting in the asset inventory.
• Third-Party Vendor Support Tool: A vendor-provided remote support or diagnostic tool (e.g., vendor_diag.exe from a specific IT service provider) may include a component that matches a Remus IOC due to shared codebases or similar naming conventions