ThreatFox: Remus IOCs

Hunt Hypothesis

This detection identifies adversary activity linked to the Remus threat actor by matching network and endpoint telemetry against specific Indicators of Compromise (IOCs) known to facilitate initial access or lateral movement. A proactive hunt is essential within Azure Sentinel to rapidly identify early-stage infections from this high-severity campaign, enabling swift containment before the adversary establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["84.247.129.0"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["84.247.129.0"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://smarwth.biz:5292"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remus IOCs detection rule in an enterprise environment:

• Scenario: Automated Endpoint Protection Updates

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently pull definition updates or threat intelligence feeds from cloud repositories that may host files matching the “Remus” signature hash or domain. If the update service initiates a connection to a shared CDN used by multiple vendors, it can trigger this IOC match.
  • Suggested Filter: Create an exclusion for the specific process names of the EDR updater services (e.g., FalconService.exe, MsMpEng.exe) when connecting to known update domains (e.g., *.crowdstrike.com, *.microsoft.com).

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Legacy backup solutions or document management systems often utilize a “Remus” module for remote synchronization. A nightly scheduled task running on the file server (e.g., Veeam, Commvault) might initiate an outbound connection to a specific archive node that matches the Remus IOC hash.
  • Suggested Filter: Exclude traffic originating from the backup service account (e.g., NT SERVICE\VeeamTransportService) and restrict the filter to the specific scheduled job window (e.g., 02:00–04:00 local time) on known backup servers.

• Scenario: Internal Development Build Pipelines

  • Context: DevOps teams using CI/CD platforms like Jenkins or GitLab often integrate third-party security scanning tools during the build phase. If a build agent pulls a container image or dependency named “Remus” from an internal artifact registry, the detection logic may flag it as an external threat rather than an internal workflow event.