ThreatFox: Remus IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating three specific Indicators of Compromise (IOCs) linked to the Remus threat actor within Azure Sentinel logs. Proactively hunting for these IOCs is critical because early identification of Remus-associated artifacts allows the SOC team to rapidly contain potential lateral movement and data exfiltration before the adversary establishes a persistent foothold in the environment.

IOC Summary

Malware Family: Remus Total IOCs: 3 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["185.194.218.82"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.194.218.82"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://zokrie.click:4536", "http://voihxd.xyz:7528"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, along with targeted exclusion strategies:

• Scheduled Endpoint Protection Scans by Defender Antivirus

  • Scenario: The Microsoft Defender Antivirus service runs a scheduled daily scan (e.g., Microsoft Defender Antivirus Service) that queries the local threat intelligence feed. This process often generates network connections or file hashes matching the Remus IOCs, particularly if the enterprise uses a cloud-connected threat intelligence layer that shares signatures with ThreatFox.
  • Filter/Exclusion: Create an exclusion rule based on the process name MsMpEng.exe (or Antimalware Service Executable) and restrict it to specific scheduled window times (e.g., 02:00–04:00 UTC) or exclude traffic originating from the internal IP range of the Endpoint Management Server.

• Automated Patch Deployment via SCCM/Intune

  • Scenario: During a monthly Windows Update deployment cycle, System Center Configuration Manager (SCCM) or Microsoft Intune agents download and verify update packages. The verification process may trigger IOCs associated with Remus if the update package includes security definitions or telemetry components that overlap with the rule’s signature set.
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe (SCCM) or IntuneAgent.exe, and specifically filter out file paths containing \Windows\CCM\ or \Program Files (x86)\Microsoft Intune Agent\.

• Enterprise Backup Jobs Using Veeam or Commvault

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault perform incremental scans of the file system. These agents often utilize internal threat scanning modules that generate network traffic and process signatures identical to the Remus IOCs, especially