ThreatFox: Remcos IOCs

Hunt Hypothesis

This hypothesis detects adversary activity involving the Remcos Remote Access Trojan by monitoring for specific indicators of compromise such as unique file hashes and network connections. Proactive hunting in Azure Sentinel is essential to identify early-stage lateral movement and data exfiltration attempts before the malware establishes persistent control over compromised endpoints.

IOC Summary

Malware Family: Remcos Total IOCs: 3 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["62.60.226.68", "77.110.115.101"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["62.60.226.68", "77.110.115.101"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["sacumpeba.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Internal Vulnerability Scanning via Qualys or Tenable

  • Context: Enterprise vulnerability scanners (e.g., Qualys Cloud Agent, Tenable Nessus) frequently execute background processes that generate network traffic patterns mimicking Remcos command-and-control (C2) behavior. These agents often connect to specific external IPs on ports 80/443 with periodic heartbeat intervals that match the rule’s IOCs.
  • Filter/Exclusion: Create a whitelist exclusion for the QualysCloudAgent.exe and TenableNessusService.exe processes. Additionally, exclude traffic originating from the internal vulnerability management subnet (e.g., 10.50.20.0/24) connecting to known Qualys/Tenable cloud endpoints.

• Scenario: Automated Software Deployment via SCCM or Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Endpoint Manager (Intune) agents often download update manifests and configuration files from external repositories. The specific file hashes or network connection signatures used during these deployment cycles can collide with the Remcos IOC signatures, particularly when downloading large payloads to temporary directories.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe. Implement a filter to suppress detections occurring during defined maintenance windows (e.g., 02:00–04:00 local time) when bulk deployments are scheduled.

• Scenario: Scheduled Backup Jobs Using Veeam or Commvault

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize a C2-like communication