ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating specific Indicators of Compromise (IOCs) linked to the Remus threat actor within Azure Sentinel logs. Proactively hunting for these signals is critical because early identification of Remus-associated IOCs enables the SOC team to rapidly contain potential lateral movement and data exfiltration before they escalate into a broader incident.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["188.245.219.133"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["188.245.219.133"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://kupzovo.shop:7567/products"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remus IOCs detection rule in an enterprise environment:

• Endpoint Protection Policy Updates via CrowdStrike Falcon

  • Scenario: The CrowdStrike Falcon sensor service (csfalcon.exe) automatically downloads updated IOC definitions from the ThreatGraph/Remus feed during its scheduled daily policy refresh window (e.g., 02:00 AM UTC), triggering a network connection to Remus endpoints.
  • Filter/Exclusion: Exclude traffic where the source process is csfalcon.exe and the destination port matches the known CrowdStrike update ports, or add the specific hash of the Falcon sensor service to the exclusion list for this rule.

• Automated Threat Intelligence Ingestion by Splunk Enterprise Security

  • Scenario: The Splunk Add-on for Threat Intelligence (TA-Remus) runs a scheduled job every 6 hours to pull new IOCs from the Remus API, generating HTTP GET requests that match the detection logic.
  • Filter/Exclusion: Create an exclusion rule based on the source hostname containing splunk-indexer or splunk-forwarder, and filter out traffic where the User-Agent string contains “Splunk-Add-on-ThreatIntel”.

• Microsoft Defender for Endpoint (MDE) Cloud Protection Sync

  • Scenario: The MDE cloud protection service (MsMpEng.exe) queries Remus IOCs to update its local threat intelligence database as part of the Windows Update scheduled task, specifically during the “Cloud Block” synchronization phase.
  • Filter/Exclusion: Exclude connections initiated by MsMpEng.exe where the destination IP belongs to the Microsoft Azure cloud range or specific Remus API endpoints known to be used by MDE integrations.

• Custom Python Script for Daily Threat Dashboard Generation