ThreatFox: Remus IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise (IOCs) linked to the Remus threat actor, which may indicate an active intrusion or persistent foothold within the environment. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.

IOC Summary

Malware Family: Remus Total IOCs: 6 IOC Types: url, domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["168.231.121.175"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["168.231.121.175"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remus
let malicious_domains = dynamic(["bdducts.click"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://jxewele.shop:4262/contacts", "http://vgfeden.shop:7728/webhooks", "http://novxlse.click:9820/addresses", "http://urbandm.click:4812/sessions"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a containerized application that includes a shared library or dependency package containing one of the Remus IOCs (e.g., a specific hash or file path) for testing purposes.
  • Filter/Exclusion: Exclude detections where the parent process is a known CI/CD agent (e.g., jenkins.exe, github-actions-runner.exe) or where the file path resides within a standard build artifact directory (e.g., C:\Jenkins\workspace\, /var/lib/jenkins/).
• Scenario: An IT administrator runs a scheduled PowerShell script to clean up temporary files or audit logs, which inadvertently copies or moves a file matching an IOC hash (e.g., a known test binary) from a shared network drive to a local staging folder.
  • Filter/Exclusion: Exclude detections if the source path is a known network share (e.g., \\fileserver\dev\) and the destination path is a local staging or temp directory (e.g., C:\Users\Public\Staging\), and the parent process is powershell.exe or cmd.exe initiated by a scheduled task.
• Scenario: A security team performs a periodic vulnerability scan using a tool like Nessus or Qualys, which downloads and executes a small probe or agent binary that matches one of the Remus IOCs to test endpoint detection capabilities.
  • Filter/Exclusion: Exclude detections where the parent process is a known vulnerability scanner agent (e.g., nessus.exe, qualys_agent.exe) or if the file is located in a dedicated scanner cache directory (e.g., C:\Program Files\Nessus\cache\).
• Scenario: A developer tests a new application build locally by running a sample executable that