ThreatFox: Remcos IOCs

Hunt Hypothesis

This rule detects adversary activity involving the Remcos remote access trojan by identifying five specific indicators of compromise that signal potential command and control or data exfiltration operations. A proactive hunt is essential in Azure Sentinel to rapidly identify and contain this high-severity threat before it establishes persistence within the enterprise network.

IOC Summary

Malware Family: Remcos Total IOCs: 5 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["204.93.220.122", "172.111.163.168", "155.103.69.20", "155.103.70.232"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["204.93.220.122", "172.111.163.168", "155.103.69.20", "155.103.70.232"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["newpapidnsorg.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, along with targeted filters or exclusions to mitigate noise in an enterprise environment:

• Scenario: Automated Security Scanning Tools Executing Hash-Based Checks

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) and vulnerability scanners (e.g., Tenable Nessus, Qualys) frequently execute background processes that generate file hashes or network connections matching the specific Remcos IOCs. These tools often run scheduled scans during off-hours that mimic the behavior of the Remcos remote administration tool.
  • Filter/Exclusion: Create a whitelist exclusion for process names and paths associated with known security vendors. Specifically, exclude alerts where the ProcessName matches C:\Program Files\CrowdStrike\csfalcon.exe, C:\Windows\System32\defender.exe, or Tenable Nessus Agent and the ParentProcess is a scheduled task service (svchost.exe with specific service names).

• Scenario: IT Admin Performing Legitimate Remote Maintenance via Scheduled Tasks

  • Context: System administrators often deploy custom PowerShell scripts or batch files to perform remote configuration management, software deployment, or log collection. If these scripts utilize the same registry keys, file paths, or network ports identified in the Remcos IOC set (e.g., creating specific mutexes or connecting to known C2 ports), they will trigger the rule.
  • Filter/Exclusion: Implement a logic filter that excludes events where the UserAccount belongs to the IT_Operations or Domain_Admins groups and the execution context is identified as a “Scheduled Task” (e.g., Task Scheduler service). Additionally, exclude specific known internal IP ranges used for management stations.

• **Scenario: Deployment of