ThreatFox: Remus IOCs

Hunt Hypothesis

This detection identifies adversary activity linked to the Remus threat actor by monitoring specific Indicators of Compromise (IOCs) that signal potential initial access or command-and-control communications within the Azure Sentinel environment. Proactive hunting for these IOCs is critical due to their high severity, enabling the SOC team to rapidly isolate and investigate early-stage intrusions before they escalate into broader lateral movements or data exfiltration events.

IOC Summary

Malware Family: Remus Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["109.104.155.94"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["109.104.155.94"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remus
let malicious_domains = dynamic(["pazona.shop"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remus IOCs detection rule in an enterprise environment:

• Scenario: The corporate Endpoint Detection and Response (EDR) solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled daily update of its threat intelligence feed, which includes the specific Remus hash signatures.

  • Filter/Exclusion: Exclude network traffic and process execution events where the parent process is C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe (or equivalent EDR agent binary) occurring during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: The Security Operations Center runs a weekly automated threat intelligence ingestion job using a Python script (threat_intel_sync.py) hosted on the SIEM server to pull new IOCs from ThreatFox, which temporarily generates network connections to the Remus infrastructure.

  • Filter/Exclusion: Create an exclusion rule for source IP addresses belonging to the internal SIEM management subnet (e.g., 10.50.20.0/24) when the initiating process name matches python.exe and the command line contains the keyword --source=threatfox.

• Scenario: The IT Operations team executes a scheduled PowerShell script (Update-RemusSignatures.ps1) to manually refresh local security policy definitions on domain controllers, triggering file system events that match the Remus IOCs.

  • Filter/Exclusion: Filter out alerts where the host is a Domain Controller (identified by OS attribute) and the process path contains \Windows\System32\WindowsPowerShell\v1.0\powershell.exe, specifically when the execution time aligns with the weekly patch Tuesday schedule.

• Scenario: A third-party vulnerability scanner (e