This hunt targets the presence of 17 known indicators of compromise linked to the Remus threat actor, which often leverage specific network artifacts or file hashes to establish persistence or exfiltrate data. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy intrusions before they escalate, ensuring rapid containment of high-severity threats that may bypass standard behavioral detections.
Malware Family: Remus Total IOCs: 17 IOC Types: ip:port, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://quicbud.shop:7647/tasks | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://smaring.shop:9895/collections | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://trencts.shop:8592/notifications | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://quicbud.shop:7647/folders | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://trencts.shop:8592/workspaces | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://futlink.click:4326/products | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://quicbud.shop:7647/categories | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://trencts.shop:8592/messages | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://doresxa.click:6271/videos | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://quicbud.shop:7647/invoices | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://trencts.shop:8592/projects | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://futlink.click:4326/accounts | botnet_cc | 2026-09-08 | 75% |
| ip:port | 2[.]25[.]206[.]107:4326 | botnet_cc | 2026-09-08 | 100% |
| ip:port | 137[.]184[.]108[.]14:9895 | botnet_cc | 2026-09-08 | 100% |
| url | hxxp://smaring.shop:9895/customers | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://trencts.shop:8592/imports | botnet_cc | 2026-09-08 | 75% |
| url | hxxp://drrizon.click:6271/documents | botnet_cc | 2026-09-08 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["137.184.108.14", "2.25.206.107"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["137.184.108.14", "2.25.206.107"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://quicbud.shop:7647/tasks", "http://smaring.shop:9895/collections", "http://trencts.shop:8592/notifications", "http://quicbud.shop:7647/folders", "http://trencts.shop:8592/workspaces", "http://futlink.click:4326/products", "http://quicbud.shop:7647/categories", "http://trencts.shop:8592/messages", "http://doresxa.click:6271/videos", "http://quicbud.shop:7647/invoices", "http://trencts.shop:8592/projects", "http://futlink.click:4326/accounts", "http://smaring.shop:9895/customers", "http://trencts.shop:8592/imports", "http://drrizon.click:6271/documents"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Legacy Application Updates via Scheduled Tasks: The Remus IOCs often include specific file hashes or paths associated with older versions of software. In a large enterprise, scheduled Task Scheduler jobs (e.g., Microsoft\Windows\Wired\UpdateOrInstall) or third-party update agents (like WSUS client scripts or Ansible playbooks) may legitimately write or execute these specific binary versions during routine patch cycles.
svchost.exe with specific service names like WaaSMonitor) or where the command line contains standard update flags (e.g., /update, /install) and the user context is SYSTEM or a dedicated svc_update account.CI/CD Pipeline Artifacts in Build Agents: In DevOps environments, build agents (e.g., Azure DevOps agents, Jenkins nodes, or GitHub Actions runners) frequently download and execute specific tool binaries or dependencies that match the IOCs. These are often temporary artifacts in build directories (e.g., C:\agent\_work\... or /home/runner/work/...) that are expected to exist during pipeline execution.
_work, workspace, build, or agent) and where the parent process is a build agent service (e.g., VstsAgent.exe, jenkins-agent.jar, or runner.sh).Development Sandbox or Test Environments: Developers often use isolated VMs or containers (e.g., Docker containers, Hyper-V VMs, or Vagrant boxes) to test software versions that match the IOCs. These environments are not part of the