ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating nine specific Indicators of Compromise (IOCs) linked to the Remus threat actor within your Azure Sentinel environment. Proactively hunting for these signatures is critical because early identification of Remus-associated artifacts enables the SOC team to rapidly isolate compromised assets and mitigate potential lateral movement before broader network impact occurs.

IOC Summary

Malware Family: Remus Total IOCs: 9 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["216.203.20.46"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["216.203.20.46"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://fresok.top:9048/customers", "http://Cryptovectorhub3.lol:5478/accounts", "http://spareon.click:8811/permissions", "http://shhsift.click:7647/webhooks", "http://fresok.top:9048/posts", "http://Cryptovectorhub3.lol:5478/customers", "http://zonxh.shop:7728/permissions", "http://fresok.top:9048/projects"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remus IOCs rule in an enterprise environment:

• Scenario: The Enterprise Endpoint Detection and Response (EDR) agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled daily scan of the “C:\Program Files\Remus” directory, triggering network connections to the specific Remus update servers identified in the IOC list.

  • Filter/Exclusion: Create an exclusion rule based on the process name falcon.sys (or MsMpEng.exe) and restrict the alert if the source IP belongs to the internal corporate subnet range (e.g., 10.x.x.x or 192.168.x.x).

• Scenario: A scheduled PowerShell job running on the Domain Controller executes a script to validate license keys for the Remus security suite, generating DNS queries and HTTP requests that match the Remus IOCs.

  • Filter/Exclusion: Exclude alerts where the process command line contains keywords like Get-RemusLicense or ValidateRemus, specifically when executed by the built-in SYSTEM account or a dedicated service account (e.g., svc_remus_admin).

• Scenario: The IT Operations team deploys a new configuration patch to the Remus management console via SCCM (System Center Configuration Manager), causing the management server to initiate outbound connections to the Remus cloud endpoints for telemetry synchronization.

  • Filter/Exclusion: Add an exclusion for source processes named ccmexec.exe or SMS_EXECUTIVE when the destination port matches standard HTTPS traffic (443) and the user context is a known SCCM service account.

• Scenario: The internal SIEM platform (e.g., Splunk or Elastic Security) runs a nightly data ingestion job that pulls logs from the Rem