This detection rule identifies active indicators of compromise linked to the Remcos Remote Access Trojan, which adversaries deploy to establish persistent command-and-control channels and exfiltrate sensitive data from compromised endpoints. Proactively hunting for these specific IOCs within Azure Sentinel is critical due to Remcos’s high severity threat level and its capability to evade traditional defenses by mimicking legitimate system processes.
Malware Family: Remcos Total IOCs: 8 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 93[.]152[.]221[.]158:2404 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 217[.]60[.]195[.]118:2404 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 161[.]248[.]179[.]98:2404 | botnet_cc | 2026-08-06 | 75% |
| domain | donta.duckdns.org | botnet_cc | 2026-08-06 | 75% |
| ip:port | 103[.]83[.]86[.]143:14642 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 155[.]103[.]69[.]20:14649 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 194[.]59[.]31[.]174:5050 | botnet_cc | 2026-08-06 | 75% |
| ip:port | 195[.]186[.]4[.]217:2466 | botnet_cc | 2026-08-06 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["103.83.86.143", "93.152.221.158", "194.59.31.174", "217.60.195.118", "195.186.4.217", "161.248.179.98", "155.103.69.20"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.83.86.143", "93.152.221.158", "194.59.31.174", "217.60.195.118", "195.186.4.217", "161.248.179.98", "155.103.69.20"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["donta.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, along with targeted filters and exclusions:
Scenario: Legitimate IT automation scripts utilizing PowerShell to query system inventory often trigger the Remcoms process hash or network connection patterns. Specifically, internal tools like SCCM (System Center Configuration Manager) or custom PowerShell Desired State Configuration (DSC) agents may spawn processes that match the Remcos executable signature while performing routine health checks.
ccmexec.exe for SCCM) and filter out events where the process path contains \Microsoft\CCM\. Additionally, exclude traffic originating from internal management subnets (e.g., 10.20.x.x) to external ports used by these agents.Scenario: Scheduled maintenance jobs running on Windows Server endpoints often execute legacy backup or monitoring utilities that share similar cryptographic hashes with the Remcos IOCs. For instance, a nightly Veeam Backup job or a SolarWinds NPM (Network Performance Monitor) agent might initiate a process that mimics the specific file hash or registry key modification associated with Remcos.
--backup, --agent-check, or specific vendor identifiers such as Veeam and SolarWinds.Scenario: Development environments frequently utilize containerized applications or CI/CD pipelines (such as Jenkins or GitLab Runners) that pull images containing dependencies with overlapping IOCs. When these runners execute build