The detection identifies potential Remcos malware activity through known IOCs, indicating an adversary may be establishing persistence and exfiltrating data. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats before significant data loss occurs.
IOC Summary
Malware Family: Remcos Total IOCs: 18 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 168[.]222[.]97[.]59:2404 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 192[.]3[.]45[.]8:5000 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 107[.]175[.]179[.]48:2404 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 23[.]95[.]103[.]219:2404 | botnet_cc | 2026-06-08 | 75% |
| domain | nanacccoz.hopto.org | botnet_cc | 2026-06-08 | 75% |
| ip:port | 182[.]23[.]2[.]163:3252 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 155[.]103[.]70[.]100:13408 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 62[.]102[.]148[.]212:37393 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 107[.]175[.]148[.]82:2404 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 146[.]70[.]244[.]90:37393 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 192[.]3[.]45[.]8:2404 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 107[.]172[.]13[.]230:3000 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 104[.]168[.]7[.]208:4231 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 195[.]177[.]94[.]115:2037 | botnet_cc | 2026-06-08 | 75% |
| domain | throtboy.duckdns.org | botnet_cc | 2026-06-08 | 75% |
| ip:port | 93[.]177[.]75[.]2:2467 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 62[.]102[.]148[.]174:37393 | botnet_cc | 2026-06-08 | 75% |
| ip:port | 107[.]173[.]63[.]252:2404 | botnet_cc | 2026-06-08 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["62.102.148.212", "107.172.13.230", "62.102.148.174", "192.3.45.8", "104.168.7.208", "107.173.63.252", "182.23.2.163", "93.177.75.2", "107.175.148.82", "155.103.70.100", "195.177.94.115", "107.175.179.48", "146.70.244.90", "23.95.103.219", "168.222.97.59"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["62.102.148.212", "107.172.13.230", "62.102.148.174", "192.3.45.8", "104.168.7.208", "107.173.63.252", "182.23.2.163", "93.177.75.2", "107.175.148.82", "155.103.70.100", "195.177.94.115", "107.175.179.48", "146.70.244.90", "23.95.103.219", "168.222.97.59"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["nanacccoz.hopto.org", "throtboy.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: Legitimate software update process
Description: A system administrator is deploying a legitimate software update that includes a file matching a Remcos IOC.
Filter/Exclusion: process.name != "msiexec.exe" OR process.name != "setup.exe" or check for process.parent.name == "task scheduler" for scheduled updates.
Scenario: Scheduled backup job using Veeam
Description: A backup job using Veeam is executing and generates a file that matches a Remcos IOC due to similar naming conventions.
Filter/Exclusion: process.name != "VeeamBackup.exe" OR process.parent.name == "task scheduler" to exclude scheduled tasks.
Scenario: Admin using PowerShell for system monitoring
Description: An admin is using PowerShell to monitor system processes and inadvertently triggers the Remcos IOC rule.
Filter/Exclusion: process.name != "powershell.exe" OR process.parent.name == "explorer.exe" for legitimate admin tasks.
Scenario: Legitimate remote access tool (e.g., LogMeIn)
Description: A remote access tool like LogMeIn is being used, and its binary matches a Remcos IOC due to similar file hashes.
Filter/Exclusion: process.name != "LogMeIn.exe" OR process.parent.name == "logmein.exe" to exclude known legitimate tools.
Scenario: System cleanup using CCleaner
Description: A system cleanup task using CCleaner generates a file that matches a Remcos IOC due to similar behavior.
Filter/Exclusion: process.name != "ccleaner.exe" OR process.parent.name == "task scheduler" to exclude automated cleanup tasks.