ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary activity involving the specific Indicators of Compromise (IOCs) linked to the Remus threat actor, which are known to facilitate initial access and lateral movement within cloud environments. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of Remus-associated IOCs allows the SOC team to identify potential compromises before they escalate into broader data exfiltration or persistent threats.

IOC Summary

Malware Family: Remus Total IOCs: 14 IOC Types: ip:port, url

Type	Value	Threat Type	First Seen	Confidence
url	hxxp://flreaow.click:6527/articles	botnet_cc	2026-08-29	75%
url	hxxp://piarl.site:9048/collections	botnet_cc	2026-08-29	75%
url	hxxp://piarl.site:9048/notifications	botnet_cc	2026-08-29	75%
url	hxxp://cryptovectorhub3.lol:5478/messages	botnet_cc	2026-08-29	75%
url	hxxp://fresok.top:9048/accounts	botnet_cc	2026-08-29	75%
ip:port	145[.]223[.]23[.]25:3215	botnet_cc	2026-08-29	100%
url	hxxp://flreaow.click:6527/categories	botnet_cc	2026-08-29	75%
url	hxxp://piarl.site:9048/posts	botnet_cc	2026-08-29	75%
url	hxxp://shhsift.click:7647/contacts	botnet_cc	2026-08-29	75%
url	hxxp://piarl.site:9048/accounts	botnet_cc	2026-08-29	75%
url	hxxp://darkfot.click:3215/transactions	botnet_cc	2026-08-28	75%
url	hxxp://shhsift.click:7647/events	botnet_cc	2026-08-28	75%
url	hxxp://piarl.site:9048/invoices	botnet_cc	2026-08-28	75%
url	hxxp://piarl.site:9048/categories	botnet_cc	2026-08-28	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["145.223.23.25"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["145.223.23.25"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://flreaow.click:6527/articles", "http://piarl.site:9048/collections", "http://piarl.site:9048/notifications", "http://cryptovectorhub3.lol:5478/messages", "http://fresok.top:9048/accounts", "http://flreaow.click:6527/categories", "http://piarl.site:9048/posts", "http://shhsift.click:7647/contacts", "http://piarl.site:9048/accounts", "http://darkfot.click:3215/transactions", "http://shhsift.click:7647/events", "http://piarl.site:9048/invoices", "http://piarl.site:9048/categories"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Remus IOCs detection rule in an enterprise environment, including targeted filters and exclusions:

• Scenario 1: Automated Endpoint Protection Scans

  • Context: Enterprise endpoints running CrowdStrike Falcon or Microsoft Defender for Endpoint (MDE) perform scheduled daily signature updates. The update mechanism often downloads definition files containing hashes that overlap with the Remus IOCs, triggering alerts when the security agent scans these specific files in the C:\ProgramData directory.
  • Filter/Exclusion: Create a rule exception to exclude processes named FalconSensorService.exe, MsMpEng.exe, and DefenderSvc from alerting on file hashes matching the Remus list when they are located within standard system update directories (e.g., C:\ProgramData\Microsoft\Windows Defender).

• Scenario 2: Third-Party Backup Agent Activity

  • Context: The organization utilizes Veeam Backup & Replication agents on file servers. During nightly backup windows, the Veeam agent (vbrsvc.exe) generates temporary staging files and logs that contain digital signatures or embedded metadata matching one of the 14 Remus IOCs, specifically those related to network communication or specific DLL versions used in legacy backups.
  • Filter/Exclusion: Exclude alerts where the parent process is vbrsvc.exe (Veeam) or vssvc.exe and the file path contains \Backup\Staging. Additionally, filter out events occurring during the defined maintenance window (e.g., 02:00 – 04:00 UTC).

• Scenario 3: Scheduled PowerShell Administrative Scripts

  • Context: IT Operations runs a nightly compliance script via Task Scheduler using powershell.exe. This script invokes