ThreatFox: Remcos IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known Remcos Remote Access Trojan indicators, which adversaries deploy to establish persistent, stealthy control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical because Remcos is frequently used in targeted attacks to exfiltrate sensitive data and maintain long-term access, making early detection essential to prevent lateral movement and data leakage.

IOC Summary

Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port, domain

Type	Value	Threat Type	First Seen	Confidence
domain	`ferdinandcumberbatchx3.duckdns.org`	botnet_cc	2026-09-24	75%
ip:port	`196[.]251[.]107[.]252:22063`	botnet_cc	2026-09-24	100%
ip:port	`155[.]103[.]71[.]242:14643`	botnet_cc	2026-09-24	100%
ip:port	`155[.]103[.]69[.]57:14646`	botnet_cc	2026-09-24	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["155.103.71.242", "155.103.69.57", "196.251.107.252"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["155.103.71.242", "155.103.69.57", "196.251.107.252"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["ferdinandcumberbatchx3.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — Remcos

False Positive Guidance

Remote Desktop Administration via RDP Gateway or Jump Hosts
- Scenario: Administrators frequently use Remcos as a lightweight, feature-rich RDP client for remote troubleshooting, especially in environments where native RDP is restricted by network segmentation or firewall rules. The client often runs from C:\Users\<Admin>\AppData\Local\Temp or a mapped drive, triggering path-based IOCs.
- Filter/Exclusion: Exclude processes where the parent is a known remote management tool (e.g., mstsc.exe, FreeRDP, UltraVNC) or where the user account belongs to a specific security group (e.g., RemoteAdmins, ITSupport). Additionally, exclude if the process is launched from a standard application directory like C:\Program Files\Remcos\ rather than a temporary folder.
Software Testing and QA Environments
- Scenario: Quality Assurance (QA) engineers or developers may use Remcos to test remote control features, screen sharing capabilities, or compatibility with different OS versions. These instances are often run from developer workstations or test VMs with non-standard user profiles.
- Filter/Exclusion: Exclude hosts tagged with environment labels such as env=qa, env=dev, or role=test. Alternatively, exclude if the user account name contains qa_, dev_, or test_ and the process is running from a project-specific directory (e.g., C:\Projects\RemcosTest\).
Legacy Application Support or Vendor Tools
- Scenario: Some legacy enterprise applications or third-party vendor support tools bundle Remcos or use it as a dependency for their remote support module. These processes may be signed by the vendor but still match the hash or path IOCs if the vendor uses an older, unpatched version.