ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt detects adversaries leveraging the Remcos Remote Access Trojan to establish persistent footholds through phishing campaigns, enabling them to exfiltrate sensitive data and execute remote commands on compromised endpoints. Proactively hunting for these indicators in Azure Sentinel is critical because Remcos’s ability to maintain long-term access allows attackers to operate undetected while escalating privileges and moving laterally within the network.

IOC Summary

Malware Family: Remcos Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["45.148.18.44"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.148.18.44"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["powerflash64.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Administration via RMM Tools

  • Context: Enterprise IT teams often use Remote Monitoring and Management (RMM) tools like ManageEngine Desktop Central, NinjaOne, or Lansweeper. These agents frequently establish outbound connections to cloud management servers using ports and protocols that mimic Remcos behavior (e.g., HTTPS on port 443 with specific User-Agent strings).
  • Filter/Exclusion: Create a whitelist exclusion for the specific Service Executable Paths of known RMM agents. Additionally, filter out traffic where the destination IP belongs to the organization’s verified RMM Cloud CIDR ranges.

• Scenario: Scheduled Backup and Monitoring Jobs

  • Context: Automated backup solutions (e.g., Veeam, Acronis Cyber Protect) or monitoring agents (e.g., SolarWinds NPM, Datadog Agent) often run scheduled tasks that periodically exfiltrate configuration data, logs, or asset inventories to central servers. These jobs may trigger the “data theft” and “command execution” signatures associated with Remcos.
  • Filter/Exclusion: Implement a time-based exclusion for known backup windows (e.g., 02:00 - 06:00 daily) or exclude specific Process Names such as VeeamAgent.exe, AcronisBackupService.exe, and DatadogAgent.exe.

• Scenario: Phishing Simulation Platforms

  • Context: Security teams utilize platforms like KnowBe4, Proofpoint, or Coveware to conduct internal phishing campaigns. These tools often deploy lightweight agents or