ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Remcos remote administration tool by matching network and endpoint telemetry against a curated set of 19 specific indicators of compromise. Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage lateral movement or command-and-control communications, enabling rapid containment before the malware establishes persistence within the environment.

IOC Summary

Malware Family: Remcos Total IOCs: 19 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	453e775ba32c43699a47bbfb2f0c9675f523d2a90c903a0e069086658d76485c	payload	2026-08-02	75%
sha256_hash	4be24ba6132ddc47ae55ee91183e7982394827b6d334e559fd24d5d056ae12a5	payload	2026-08-02	75%
sha256_hash	c4fa2144908f8beb04d4c9c74070be2e08cdbdfcebcb368074fce577fe98a907	payload	2026-08-02	75%
sha256_hash	256c87c965bc1ba9276df733da86a3a713d9f981eed04ffe15e160311bc070f9	payload	2026-08-02	75%
sha256_hash	903395145ce286d28296682ef245ac7d564db21d0757834961cdc903239d45e0	payload	2026-08-02	75%
sha256_hash	9f8e25e8b2b3fd1185e663d1060d0d43f620897f7ef5353738dec2078672171a	payload	2026-08-02	75%
sha256_hash	4f722dfacbe424bcde50dfc36e8629748f2721474c34978e28eb7c4e45ce4318	payload	2026-08-02	75%
sha256_hash	30528573c924a4b79d00403f9cd6fee37502e3c4434b1df16a302ff084192941	payload	2026-08-02	75%
sha256_hash	741cc13f514227ce73d22363e5488730dc56028cde4970a8eb734c447a46faab	payload	2026-08-02	75%
sha256_hash	9e44cbc8d47e63cb16abc6f1dfa678a1f1ec1197a2d0be161ab06cf02f638cae	payload	2026-08-02	75%
sha256_hash	b366c5797d0a60aaa4d40b121586ed881a7f92eb9050c88922fcae575c4c0ea8	payload	2026-08-02	75%
sha256_hash	d417e9dc79b008129b979c09cde0c9510f30f432361ab7fd66a133722e753e79	payload	2026-08-02	75%
sha256_hash	295614f9bf8a66878ed5429b3f2bb33981bae48c993964e79702a49d57e536d2	payload	2026-08-02	75%
sha256_hash	57ee67384c9545917776b27512c45cbdf8908a72e150489bfc3ffbf8c1309722	payload	2026-08-02	75%
sha256_hash	140eb57e93274c31571ed13bafc3d36267e970620d7b588b7735cec7b41cfbb9	payload	2026-08-02	75%
sha256_hash	d1d4d72e4759b1bb95cc16f8e2e3dbded8409f68bc0d761c51c27071778946be	payload	2026-08-02	75%
sha256_hash	f3a01fddd8e86301d795ebf2feb416049ce8bc237a97637c796f8ab84e3ab878	payload	2026-08-02	75%
sha256_hash	4f4dfad2cd9ff21d88353f568982655c240bee96a4034b05e6c1efacb515622e	payload	2026-08-02	75%
sha256_hash	54706d8d39e619a4e7e5a882d304dc34a86d9756da1f0be9df420ac60b8847ab	payload	2026-08-02	75%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Remcos
let malicious_hashes = dynamic(["453e775ba32c43699a47bbfb2f0c9675f523d2a90c903a0e069086658d76485c", "4be24ba6132ddc47ae55ee91183e7982394827b6d334e559fd24d5d056ae12a5", "c4fa2144908f8beb04d4c9c74070be2e08cdbdfcebcb368074fce577fe98a907", "256c87c965bc1ba9276df733da86a3a713d9f981eed04ffe15e160311bc070f9", "903395145ce286d28296682ef245ac7d564db21d0757834961cdc903239d45e0", "9f8e25e8b2b3fd1185e663d1060d0d43f620897f7ef5353738dec2078672171a", "4f722dfacbe424bcde50dfc36e8629748f2721474c34978e28eb7c4e45ce4318", "30528573c924a4b79d00403f9cd6fee37502e3c4434b1df16a302ff084192941", "741cc13f514227ce73d22363e5488730dc56028cde4970a8eb734c447a46faab", "9e44cbc8d47e63cb16abc6f1dfa678a1f1ec1197a2d0be161ab06cf02f638cae", "b366c5797d0a60aaa4d40b121586ed881a7f92eb9050c88922fcae575c4c0ea8", "d417e9dc79b008129b979c09cde0c9510f30f432361ab7fd66a133722e753e79", "295614f9bf8a66878ed5429b3f2bb33981bae48c993964e79702a49d57e536d2", "57ee67384c9545917776b27512c45cbdf8908a72e150489bfc3ffbf8c1309722", "140eb57e93274c31571ed13bafc3d36267e970620d7b588b7735cec7b41cfbb9", "d1d4d72e4759b1bb95cc16f8e2e3dbded8409f68bc0d761c51c27071778946be", "f3a01fddd8e86301d795ebf2feb416049ce8bc237a97637c796f8ab84e3ab878", "4f4dfad2cd9ff21d88353f568982655c240bee96a4034b05e6c1efacb515622e", "54706d8d39e619a4e7e5a882d304dc34a86d9756da1f0be9df420ac60b8847ab"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — Remcos

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, along with suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Scheduled Backup or Patching Jobs Executing Known Hashes

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or patch management tools (e.g., SCCM/MECM, Ivanti) often utilize specific executable hashes that may overlap with the Remcos IOC list. If a scheduled job runs during business hours and executes a process matching one of the 19 IOCs, it triggers an alert.
  • Suggested Filter: Create an exclusion based on the Process Command Line containing keywords like “Veeam,” “SCCM,” or “Ivanti” combined with a whitelist of specific file paths (e.g., C:\Program Files\Microsoft Configuration Manager\). Additionally, filter out events where the Parent Process Name is a known service host (e.g., svchost.exe, TaskHost.exe) running under a System or Enterprise Service account.

• Scenario: Security Scanning by Endpoint Protection Agents

  • Context: The endpoint detection and response (EDR) agent itself (e.g., CrowdStrike Falcon, SentinelOne, Carbon Black) frequently scans the system registry and file system. If the EDR engine’s scanning module or a specific signature update installer matches one of the Remcos IOCs, it generates a false positive during routine maintenance windows.
  • Suggested Filter: Exclude events where the Process Name belongs to the enterprise EDR suite (e.g., FalconSensor.exe, SentinelOneAgent.exe) or where the User Account is a dedicated service account (e.g., NT SERVICE\CrowdStrike). Implement a time-based filter to suppress alerts during known