ThreatFox: RemoteX IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving three specific Indicators of Compromise (IOCs) linked to the RemoteX threat actor, signaling potential reconnaissance or initial access attempts within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly validate and contain early-stage threats before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Malware Family: RemoteX Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`1dcab6f5621e7c3b7096bf817bf5ba5b`	payload	2026-07-25	95%
sha256_hash	`faad7b41abeef3da7099a6815d7799c647108a13d2fc397ab2ee468899c8a5c4`	payload	2026-07-25	95%
sha1_hash	`3038c746d4059f21c02b6ba0a3aa3a70ad1450ec`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - RemoteX
let malicious_hashes = dynamic(["1dcab6f5621e7c3b7096bf817bf5ba5b", "faad7b41abeef3da7099a6815d7799c647108a13d2fc397ab2ee468899c8a5c4", "3038c746d4059f21c02b6ba0a3aa3a70ad1450ec"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — RemoteX

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: RemoteX IOCs detection rule:

Scenario: Automated Backup Job Execution via Managed Service Provider
- Context: The enterprise utilizes a third-party managed service provider (MSP) that runs nightly backup jobs using Veeam Backup & Replication. The MSP’s remote management agent connects to the environment using specific RemoteX IOCs (IP addresses and hashes) to initiate data transfers, triggering the rule.
- Suggested Filter: Create a whitelist exclusion in the SIEM for the specific source IP ranges of the Veeam backup server and the MSP’s dedicated jump host. Additionally, exclude the process name veeam.exe when the destination port is 443 or 9028 (Veeam default ports).
Scenario: Scheduled Patch Deployment by IT Operations
- Context: The internal IT team uses Microsoft Endpoint Configuration Manager (SCCM) to deploy monthly security patches. During the deployment window, SCCM agents pull update manifests from a remote repository that utilizes RemoteX infrastructure components, causing the detection logic to match the IOCs.
- Suggested Filter: Implement a time-based exclusion rule that suppresses alerts between 02:00 and 04:00 UTC on the first Tuesday of every month (the standard patch window). Alternatively, exclude events where the ProcessName is ccmsetup.exe or wsappx.exe originating from the internal SCCM site server IP.
Scenario: Cloud Identity Federation Synchronization
- Context: The organization performs hourly synchronization between on-premise Active Directory and Azure Active Directory (Entra ID) using Azure AD Connect. This service communicates with external identity federation endpoints that share the RemoteX IOCs, generating legitimate network traffic flagged as suspicious