ThreatFox: RemoteX IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by matching network and endpoint telemetry against three specific Indicators of Compromise (IOCs) linked to the RemoteX threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly detect early-stage intrusions and mitigate potential lateral movement before adversaries can establish persistence within the environment.

IOC Summary

Malware Family: RemoteX Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`fa4b30b7cc5b13ed11c7658dd3ce4f2f2e7d3488c95f0a728d11a3186d6a4671`	payload	2026-07-31	95%
sha1_hash	`406993c2ec445d078e354d73c62498e66cf84a22`	payload	2026-07-31	95%
md5_hash	`910f7ad5d25665e50980e7c2b8fe7c7c`	payload	2026-07-31	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - RemoteX
let malicious_hashes = dynamic(["fa4b30b7cc5b13ed11c7658dd3ce4f2f2e7d3488c95f0a728d11a3186d6a4671", "406993c2ec445d078e354d73c62498e66cf84a22", "910f7ad5d25665e50980e7c2b8fe7c7c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — RemoteX

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: RemoteX IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Patch Management Deployment
- Context: The organization uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy security patches. During the nightly maintenance window, the patching engine downloads RemoteX update signatures or agent components from a trusted vendor repository, triggering the IOCs associated with RemoteX files and network connections.
- Filter/Exclusion: Create an exclusion rule that suppresses alerts for processes running under the System account or specific service names (e.g., ccmexec.exe, msiexec.exe) when they originate from the internal patch management server IP range (10.x.x.x). Additionally, whitelist the specific hash of the RemoteX installer used in the deployment.
Scenario: Scheduled Security Agent Health Checks
- Context: The enterprise security suite (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) runs a scheduled daily job at 02:00 AM to verify agent connectivity and update definition databases. This process initiates outbound connections to RemoteX cloud endpoints for telemetry validation, matching the detection logic for RemoteX IOCs.
- Filter/Exclusion: Apply a time-based filter to ignore detections occurring between 01:30 and 02:30 daily. Alternatively, exclude alerts where the parent process is identified as the primary security agent daemon (e.g., FalconSensor.exe, ssd.exe) and the destination port matches the known RemoteX telemetry ports (typically 443 or specific vendor ports).
Scenario: Admin Manual Remediation via RMM Tools
- Context: A System Administrator uses a Remote