ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Remus threat actor by monitoring three specific Indicators of Compromise (IOCs) within Azure Sentinel logs. Proactively hunting for these signatures is critical because early identification of Remus-associated artifacts allows the SOC team to isolate potential compromises before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["62.171.177.27", "77.42.90.175"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["62.171.177.27", "77.42.90.175"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://fimmora.surf:6504"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Remus IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Engine Updates & Definition Refreshes

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled nightly update. During this process, the agent downloads and executes new signature definitions that may contain file hashes or network artifacts matching the Remus IOCs. This often triggers alerts when the engine scans its own installation directory or temporary download folders.
  • Filter/Exclusion: Create an exclusion for processes originating from the specific Endpoint Protection vendor’s service path (e.g., C:\Program Files\CrowdStrike\* or C:\Windows\System32\mssecsvc.exe). Additionally, filter out network traffic where the destination IP belongs to the known update server ranges of the EDR provider.

• Enterprise Software Supply Chain Scans

  • Scenario: A scheduled vulnerability management tool (such as Tenable Nessus or Qualys) runs a comprehensive agent-based scan across the production environment. The scanner’s internal modules may execute scripts or temporary binaries that interact with external threat intelligence feeds, inadvertently generating network connections to IPs or file hashes associated with the Remus IOC set during the data synchronization phase.
  • Filter/Exclusion: Exclude alerts where the initiating process is the specific vulnerability scanner agent (e.g., qualyspc.exe or tenable.agent.exe). Furthermore, add a time-based filter to suppress alerts occurring strictly within the maintenance window of these scheduled scans (e.g., 02:00 – 04:00 UTC on Sundays).

• IT Administration and Patch Management Deployments

  • Scenario: The IT Operations team utilizes a patch management solution like SCCM (System Center Configuration