ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies active adversary behavior by monitoring Azure Sentinel logs for matches against nine specific Indicators of Compromise (IOCs) linked to the Remus threat actor. Proactively hunting for these IOCs is critical because early identification of Remus activity enables the SOC team to rapidly isolate affected assets and mitigate potential data exfiltration or lateral movement before broader compromise occurs.

IOC Summary

Malware Family: Remus Total IOCs: 9 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["45.43.143.17", "45.148.146.52"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.43.143.17", "45.148.146.52"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://maxhealthinsadvantage.com:9403", "http://kinderplow.com:5782", "http://staxta.click:5627", "http://sahalexchange.com:9504", "http://onesdto.shop:2535", "http://azurhay.shop:8539", "http://slyfogx.shop:5776"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, including targeted filters and exclusions tailored for an enterprise environment:

• Scenario: Security Tool Updates via Scheduled Tasks

  • Context: Enterprise endpoints often run automated update jobs (e.g., via Windows Task Scheduler or SCCM) that download configuration files from the vendor’s cloud infrastructure. If the Remus IOC list includes a specific hash or URL used for these updates, legitimate background processes will trigger alerts.
  • Filter/Exclusion: Exclude process paths matching C:\Program Files\Remus Security\bin\remus_updater.exe and any network connections to the vendor’s update domain (e.g., *.remus-security.com) initiated by this specific executable during business hours (08:00–18:00).

• Scenario: Admin-Driven Threat Intelligence Ingestion

  • Context: Security Operations Center (SOC) analysts frequently import new IOCs into the SIEM or EDR platform manually using PowerShell scripts or API calls. If the detection logic monitors file creation events, a script running on a jump host to ingest the Remus feed will generate hits that mimic an active threat.
  • Filter/Exclusion: Create a rule exclusion for process names containing PowerShell.exe when executed by service accounts (e.g., DOMAIN\svc-siem-ingest) and specifically targeting file paths within the ingestion directory (e.g., C:\Temp\IOC_Ingestion\).

• Scenario: Cloud Backup and Replication Jobs

  • Context: Enterprise backup solutions like Veeam or Rubrik often replicate data to cloud storage buckets. If the Remus IOCs include specific file hashes or artifact signatures that overlap with standard backup metadata files, scheduled nightly backups will generate high-volume false positives.