ThreatFox: Remus IOCs

Hunt Hypothesis

This detection identifies adversary activity linked to the Remus threat actor by monitoring seven specific indicators of compromise across the Azure Sentinel environment. Proactive hunting is essential to rapidly isolate and analyze potential intrusions from this sophisticated group before they can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Remus Total IOCs: 7 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["31.97.133.166"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.97.133.166"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://cdire.shop:9048/sessions", "http://bravplo.click:7713/tasks", "http://uiccvbk.click:8839/invoices", "http://shhsift.click:7647/users", "http://cdire.shop:9048/accounts", "http://flreaow.click:6527/webhooks"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise antivirus solutions like Microsoft Defender for Endpoint or CrowdStrike Falcon often perform daily signature updates or heuristic scans that generate network traffic matching the Remus IOCs (specifically known C2 domains or hash patterns). These legitimate scans may trigger alerts when the security tool queries external reputation services.
  • Filter/Exclusion: Create a filter to exclude events where the ProcessName is one of the trusted EDR agents (e.g., MsMpEng.exe, FalconSensorService.exe) AND the UserAccount matches a dedicated service account (e.g., svc-antivirus-updates).

• Scenario: Automated Patch Management Deployments

  • Context: During nightly maintenance windows, tools like Microsoft SCCM/Intune, Ansible, or Jenkins pipelines execute patch deployment scripts. These jobs often initiate outbound connections to vendor repositories that share IP ranges or domain suffixes with the Remus IOCs, mimicking command-and-control traffic.
  • Filter/Exclusion: Exclude alerts occurring within a specific time window (e.g., 01:00–04:00 local time) where the SourceHost belongs to the “Patch Management” Active Directory Organizational Unit (OU) and the destination port is standard HTTPS (443).

• Scenario: Third-Party Cloud Backup Operations

  • Context: Enterprise backup solutions such as Veeam, Rubrik, or Acronis Cyber Protect periodically sync metadata and logs to cloud storage providers. If these vendors utilize infrastructure overlapping with the Remus IOC list, their