This hunt targets the presence of known IOCs associated with Remcos, a commercial remote access trojan frequently used by adversaries to establish persistent, stealthy control over compromised endpoints. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate infected systems before the attacker can leverage the RAT for lateral movement, credential theft, or data exfiltration.
Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 5[.]175[.]182[.]85:2404 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 207[.]244[.]87[.]65:2404 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 102[.]220[.]163[.]40:2404 | botnet_cc | 2026-09-21 | 100% |
| ip:port | 91[.]92[.]41[.]153:2404 | botnet_cc | 2026-09-21 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["207.244.87.65", "5.175.182.85", "91.92.41.153", "102.220.163.40"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["207.244.87.65", "5.175.182.85", "91.92.41.153", "102.220.163.40"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Remote Desktop Administration via RDP Clients: Legitimate IT support or helpdesk staff often use third-party RDP clients like Microsoft Remote Desktop or mRemoteNG to manage Windows servers. If the Remcos IOCs include specific registry keys (e.g., HKCU\Software\Remcos) or file paths that overlap with generic RDP client configurations or cached credentials, these sessions may trigger the rule.
mstsc.exe, remoteng.exe) and exclude registry writes under HKCU\Software that are not explicitly named “Remcos” but match generic RDP configuration paths.Software Deployment via SCCM or Intune: Enterprise endpoint management tools like Microsoft System Center Configuration Manager (SCCM) or Microsoft Intune frequently deploy applications, patches, or configuration scripts to endpoints. If the Remcos IOCs include specific file hashes or directory structures (e.g., C:\Program Files\Remcos\) that are used as staging areas or temporary deployment locations by these tools, the rule may fire during routine patching cycles.
ccmexec.exe (SCCM) or IntuneAgent.exe, and exclude file paths under C:\Windows\CCM or C:\ProgramData\Intune.Legacy Application Updates: Some older enterprise applications or third-party software suites (e.g., Adobe Creative Cloud, Citrix Receiver) may use similar directory naming conventions or registry keys for their update mechanisms. If the Remcos IOCs include generic file names or registry keys that are also used by these legitimate applications for self-updating or configuration storage, false positives can occur during scheduled update windows.