ThreatFox: Remus IOCs

Hunt Hypothesis

This detection identifies potential Remus ransomware activity by monitoring for known Indicators of Compromise (IOCs) associated with its initial infection and lateral movement phases. Proactively hunting for these signals in Azure Sentinel is critical to enable rapid containment before the adversary encrypts critical assets, thereby minimizing operational downtime and data loss.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["85.31.60.169", "2.56.244.52"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["85.31.60.169", "2.56.244.52"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://touggch.click:9022"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule in an enterprise environment, including targeted filters and exclusions:

• Scenario: Antivirus Engine Scanning of Ransomware Definitions

  • Context: Enterprise endpoint protection tools (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently download and unpack the latest Remus malware definition packs or signature updates. During this process, the AV engine may instantiate a temporary file matching the Remus IOCs (specifically hash or file path patterns) while verifying the update package itself, triggering the rule before the actual deployment occurs.
  • Filter/Exclusion: Create an exclusion based on the Process Name of the antivirus service (e.g., MsMpEng.exe, FalconSensorService.exe) and exclude any file paths located within the vendor’s specific update directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Updates).

• Scenario: Scheduled Backup Jobs Processing Encrypted Archives

  • Context: Automated backup solutions like Veeam Backup & Replication or Commvault often run nightly jobs that compress and encrypt large datasets. If the backup agent creates a temporary staging file with an extension or hash structure similar to Remus ransomware artifacts (often mimicking .remus or specific encrypted extensions), the detection engine may flag this legitimate encryption activity as suspicious ransomware behavior.
  • Filter/Exclusion: Exclude processes running under the context of known backup services (e.g., VeeamBRService.exe, commvault_agent.exe) and filter out events occurring within designated backup windows (e.g., 02:00–06:00 local time) where file creation rates exceed a specific threshold.

• Scenario: IT Admin Deployment of Patched Applications via SCCM

  • Context: System Center