ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the Remus threat actor by correlating four specific Indicators of Compromise (IOCs) within Azure Sentinel logs. Proactively hunting for these signatures is critical because early identification of Remus-associated artifacts allows the SOC team to rapidly isolate potential compromises before they escalate into broader lateral movements or data exfiltration events.

IOC Summary

Malware Family: Remus Total IOCs: 4 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["45.141.27.68", "72.60.121.225"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.141.27.68", "72.60.121.225"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://miedorama.com:4959", "http://angect.xyz:7838"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, tailored for a legitimate enterprise environment:

• Endpoint Protection Policy Updates via CrowdStrike Falcon

  • Scenario: The global security team pushes a scheduled configuration update to all Windows endpoints using CrowdStrike Falcon. This process triggers the remus service (or related telemetry agents) to download and validate new IOCs, generating network traffic that matches the Remus signature.
  • Filter/Exclusion: Exclude alerts where the source process is C:\Program Files\CrowdStrike\fs.exe or the parent process is falcon-sensor.exe, specifically during the maintenance window (e.g., 02:00 – 04:00 UTC).

• Automated Patch Management via Microsoft SCCM/MECM

  • Scenario: A scheduled job in System Center Configuration Manager (SCCM) executes a software update task for the “Remus Security Suite” itself. During this deployment, the installer communicates with the Remus cloud repository to fetch definition updates, triggering the 4 IOCs associated with the rule logic.
  • Filter/Exclusion: Create an exclusion for traffic originating from the SCCM Management Point server IP range (e.g., 10.20.x.x) where the destination port is 443 and the user agent string contains “SCCM-Client” or “Microsoft-Windows-Update-Agent”.

• IT Admin Manual Remediation via PowerShell Scripts

  • Scenario: An IT administrator runs a custom PowerShell script (Invoke-RemusScan.ps1) on a specific server cluster to manually verify IOC integrity before a quarterly audit. The script invokes the Remus CLI tool, which establishes connections to the ThreatFox backend, mimicking the behavior of an active threat detection event.