ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating nine specific Indicators of Compromise (IOCs) linked to the Remus threat actor within Azure Sentinel logs. Proactively hunting for these IOCs is critical because early identification of Remus-related artifacts enables the SOC team to rapidly isolate affected assets and mitigate potential data exfiltration or lateral movement before the adversary establishes a persistent foothold.

IOC Summary

Malware Family: Remus Total IOCs: 9 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["191.252.159.33", "72.61.112.206"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["191.252.159.33", "72.61.112.206"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://tokjoza.shop:5200/settings", "http://shkpiva.shop:5627/notifications", "http://beljaro.shop:2536/folders", "http://tokjoza.shop:5200/orders", "http://onesdto.shop:2535/collections", "http://beljaro.shop:2536/tags", "http://beljaro.shop:2536"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule in an enterprise environment, along with targeted filtering strategies:

• Scenario: Scheduled Antivirus Definition Updates via Microsoft Endpoint Configuration Manager (MECM)

  • Context: The organization uses MECM to push daily definition updates to endpoints. The update process often triggers network connections or file hashes that match the Remus IOCs because the update server or payload shares a common infrastructure with known benign traffic patterns associated with the rule’s logic.
  • Filter/Exclusion: Create an exclusion based on the Process Name (e.g., ccmexec.exe) and the specific Source IP of the internal MECM distribution point, ensuring only connections initiated by this process from that subnet are ignored.

• Scenario: Automated Backup Jobs Running via Veeam Backup & Replication

  • Context: Nightly backup jobs utilize a service account that connects to remote storage repositories. The Remus IOCs may include file hashes or network signatures that overlap with the proprietary protocols used by Veeam’s transport services, causing the rule to flag legitimate data transfer as suspicious activity.
  • Filter/Exclusion: Exclude events where the User Account matches the specific backup service account (e.g., svc-veeam-backup) and the Destination Port aligns with the Veeam repository ports (typically 9392 or custom TCP ranges).

• Scenario: Third-Party Cloud Sync Operations by OneDrive for Business

  • Context: Users frequently sync large document libraries to OneDrive. The background synchronization process generates file hashes and network sessions that can mimic the behavioral signatures of Remus IOCs, particularly when syncing encrypted or compressed archives.
  • Filter/Exclusion: Implement a filter excluding events where the Process Command Line