ThreatFox: Remcos IOCs

Hunt Hypothesis

This detection rule identifies indicators of compromise linked to the Remcos remote access trojan (RAT), which adversaries deploy to establish persistent footholds and exfiltrate sensitive data through covert command-and-control channels. A proactive hunt for these specific IOCs within Azure Sentinel is critical to uncover stealthy infections that may evade standard signature-based defenses, ensuring early containment of potential lateral movement and data breaches.

IOC Summary

Malware Family: Remcos Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["58.96.75.176"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["58.96.75.176"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["papilawdns.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Remcos IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Remote Management Software Updates

  • Context: Enterprise endpoints running Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons often utilize background services that match Remcos network signatures. When these tools perform scheduled agent updates or inventory scans, they may generate outbound connections to update servers using ports and user-agent strings similar to the Remcos beacon traffic.
  • Filter/Exclusion: Exclude processes named ccmexec.exe (SCCM), IvantiAgentService.exe, or wuauserv.exe when connecting to known corporate IP ranges or specific update domains (e.g., *.microsoft.com, *.ivanti.com).

• Scenario: Scheduled PowerShell Administrative Scripts

  • Context: IT Operations teams frequently deploy scheduled tasks using Windows Task Scheduler that execute PowerShell scripts for patch compliance checks or log aggregation. These scripts often invoke powershell.exe to query external threat intelligence feeds or internal dashboards, creating network traffic patterns (specifically HTTP/HTTPS POST requests with JSON payloads) that mimic the Remcos command-and-control (C2) communication logic.
  • Filter/Exclusion: Create a rule exclusion for powershell.exe processes launched by the system account (NT AUTHORITY\SYSTEM) or specific service accounts (e.g., svc-admin-scripts) where the parent process is Taskschd.exe.

• Scenario: Third-Party Backup and Monitoring Agents

  • Context: Legacy backup solutions like Veeam Agent for Windows or monitoring tools such as SolarWinds NPM often run persistent background services that periodically “phone home” to report status. These agents utilize TCP connections with specific headers that can overlap