ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt hypothesis detects the presence of Remus ransomware indicators within Azure Sentinel by identifying known threat intelligence signatures associated with file encryption and security disablement behaviors. Proactive hunting for these IOCs is critical to enable early detection before widespread data encryption occurs, allowing the SOC team to isolate affected systems and prevent cryptocurrency payment demands from impacting business continuity.

IOC Summary

Malware Family: Remus Total IOCs: 11 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["72.62.195.74"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["72.62.195.74"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://shkpiva.shop:5627/categories", "http://beljaro.shop:2536/attachments", "http://topxgax.click:4930/documents", "http://tokjoza.shop:5200/workspaces", "http://tokjoza.shop:5200/projects", "http://shkpiva.shop:5627/payments", "http://beljaro.shop:2536/settings", "http://tokjoza.shop:5200/products", "http://shkpiva.shop:5627/documents", "http://beljaro.shop:2536/addresses"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Enterprise Backup Agent File Encryption

  • Context: Scheduled backup jobs (e.g., Veeam, Commvault, or Rubrik agents) running on file servers often encrypt large volumes of data locally before transmission to the cloud. The Remus rule may detect these bulk encryption operations as ransomware activity because they mimic the rapid file modification and extension changes typical of Remus.
  • Filter/Exclusion: Create a whitelist exclusion based on the specific process names of backup agents (e.g., Veeam.Backup.Service.exe, Commvault.CentralService.exe) and restrict the rule to exclude files within known backup directories (e.g., D:\BackupData\*).

• Scenario: Antivirus Engine Real-Time Scanning

  • Context: Endpoint protection suites like Microsoft Defender for Endpoint or Symantec Endpoint Protection frequently perform real-time scanning that involves locking and temporarily encrypting/decrypting files during deep scans. This behavior can trigger the “file encryption” heuristic of the Remus rule, especially when scanning large user profile directories (C:\Users\*).
  • Filter/Exclusion: Exclude processes belonging to known EDR/Antivirus vendors from the detection logic. Specifically, add a filter where ProcessName IN (‘MsMpEng.exe’, ‘SymantecClient.exe’) AND ProcessPath contains the vendor installation directory (e.g., C:\Program Files\Microsoft Defender\).

• Scenario: Automated Patch Management and Software Deployment

  • Context: System administrators using tools like SCCM, Intune, or Ansible often deploy software updates that involve extracting compressed archives (.zip, .7z) which contain encrypted payloads