This hunt targets the presence of known indicators of compromise associated with Remcos, a commercial remote access trojan frequently used for data exfiltration and persistent control. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary establishes a stable foothold or leverages the RAT for lateral movement and credential theft.
Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 196[.]251[.]121[.]57:8080 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 46[.]183[.]223[.]30:465 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 128[.]90[.]103[.]184:2015 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 2[.]27[.]62[.]228:60201 | botnet_cc | 2026-09-22 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["196.251.121.57", "128.90.103.184", "46.183.223.30", "2.27.62.228"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["196.251.121.57", "128.90.103.184", "46.183.223.30", "2.27.62.228"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom internal build agent or CI/CD runner that uses a shared library or binary with a hash collision or similar naming convention to one of the Remcos IOCs (e.g., a generic helper.dll or update.exe located in a non-standard path like C:\Program Files\InternalTools\).
C:\Program Files\InternalTools\ or C:\BuildAgents\ and the parent process is a known build service (e.g., vstsagent.exe, jenkins.exe, or dockerd.exe).Scenario: An IT administrator manually installs a legacy third-party utility (e.g., a specific version of a PDF editor or remote desktop client) that contains a component with an IOC hash or name matching the Remcos signature, often placed in C:\Users\<Admin>\AppData\Local\ or C:\Program Files (x86)\.
DOMAIN\svc-itadmin, DOMAIN\jsmith) where the executable name is in a whitelist of approved legacy software (e.g., acrobat.exe, rdpclient.exe) and the file age is greater than 30 days.Scenario: A scheduled maintenance job runs a script that downloads and executes a temporary helper binary from an internal file share (e.g., \\fileserver\tools\) to perform disk cleanup or log rotation, and the binary’s hash or filename matches one of the Remcos IOCs due to reuse of a common open-source component.
C:\Windows\Temp\ or `C:\Users<User>\AppData\