ThreatFox: Remus IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Indicators of Compromise (IOCs) associated with the Remus threat actor, which often signal active reconnaissance or initial access attempts within the environment. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify and isolate compromised assets before the adversary can establish a foothold or execute lateral movement.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["198.177.124.177"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["198.177.124.177"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://teculse.click:9210/sessions", "http://fuarnpp.shop:5627/notifications"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a containerized application that includes a shared library or binary hash matching one of the Remus IOCs. The deployment agent (e.g., kubectl or docker) writes the file to a standard build artifact directory.

  • Filter/Exclusion: Exclude events where the parent process is a known CI/CD agent (e.g., java.exe, node.exe, docker.exe) and the file path resides within a designated build or artifact directory (e.g., C:\Jenkins\workspace\, /home/ci/artifacts/).

• Scenario: An IT administrator performs a manual software update or patching task using a tool like SCCM (System Center Configuration Manager) or PDQ Deploy, which downloads and executes a patch package. The patch installer contains a component with a hash that coincidentally matches a Remus IOC due to a common dependency or shared library.

  • Filter/Exclusion: Exclude events where the parent process is a known deployment tool (e.g., ccmsetup.exe, pdqdeploy.exe) and the action is a file write or execution from a standard patch or software distribution directory (e.g., C:\Windows\CCM\, C:\Program Files\Patch Management\).

• Scenario: A security team conducts a periodic vulnerability scan or integrity check using a tool like Qualys, Tenable, or a custom PowerShell script. The scanner downloads a baseline hash database or a test binary to a temporary folder to compare against known good/bad hashes, triggering the IOC match.

  • Filter/Exclusion: Exclude events where the parent process is a known scanning or monitoring tool (e.g., qualysagent.exe, tenableagent.exe, powershell.exe) and the file path is