ThreatFox: Remus IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by correlating four specific Indicators of Compromise (IOCs) linked to the Remus threat actor within Azure Sentinel logs. Proactively hunting for these IOCs is critical because early identification of Remus-associated artifacts enables the SOC team to rapidly contain potential lateral movement and data exfiltration before broader compromise occurs.

IOC Summary

Malware Family: Remus Total IOCs: 4 IOC Types: ip:port, url

Type	Value	Threat Type	First Seen	Confidence
ip:port	`134[.]209[.]42[.]122:9895`	botnet_cc	2026-07-29	100%
ip:port	`185[.]53[.]179[.]146:7527`	botnet_cc	2026-07-29	75%
url	`hxxp://vifroup.biz:7527`	botnet_cc	2026-07-29	75%
url	`hxxp://strmer.top:5292`	botnet_cc	2026-07-29	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["134.209.42.122", "185.53.179.146"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["134.209.42.122", "185.53.179.146"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://vifroup.biz:7527", "http://strmer.top:5292"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Remus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, along with suggested filters and exclusions tailored for a legitimate enterprise environment:

Scenario: Scheduled Antivirus Definition Updates via Microsoft Defender for Endpoint
- Context: The daily automated update job for Microsoft Defender often pulls definition files from the same cloud infrastructure that hosts Remus IOCs. If the update server’s IP or hash matches one of the Remus signatures, it triggers a hit during the standard 03:00 AM maintenance window.
- Filter/Exclusion: Create an exclusion based on Process Name (MsMpEng.exe) and Parent Process (Task Scheduler), specifically filtering out alerts occurring between 02:00 and 04:00 UTC where the destination IP belongs to the Microsoft Azure CDN range.
Scenario: Automated Backup Jobs Using Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication frequently communicate with cloud repositories using specific endpoints that may overlap with Remus IOCs. During nightly full backups, the backup proxy service initiates connections to these external IPs, generating network flow logs that match the detection logic.
- Filter/Exclusion: Exclude alerts where the Source Process is Veeam.Backup.Service.exe or commvault.cmd and the destination port is 443. Additionally, add a filter for specific backup proxy server hostnames (e.g., Backup-Proxy-01) to whitelist them permanently.
Scenario: Software Deployment via SCCM/Intune Configuration Manager
- Context: When deploying patches or new applications using Microsoft Endpoint Configuration Manager (SCCM), the client agents download manifests and payloads from distribution points that may share infrastructure with Remus IOCs.