ThreatFox: Remcos IOCs

Hunt Hypothesis

The detection identifies potential Remcos malware activity through known IOCs, indicating an adversary may be establishing persistence or exfiltrating data. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats early.

IOC Summary

Malware Family: Remcos Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["107.173.9.99"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["107.173.9.99"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["vsc888x.online"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

• Scenario: Legitimate system update or patching process using Remcos as part of a managed service provider (MSP) tool
  Filter/Exclusion: process.name != "Remcos.exe" OR process.parent.name == "Windows Update" OR process.parent.name == "msiexec.exe"

• Scenario: Scheduled backup job using Remcos as a remote management tool for endpoint inventory
  Filter/Exclusion: process.name != "Remcos.exe" OR process.parent.name == "Task Scheduler" OR process.command_line contains "backup"

• Scenario: IT admin using Remcos to remotely manage a group of endpoints during a maintenance window
  Filter/Exclusion: process.name != "Remcos.exe" OR process.parent.name == "Remote Desktop Services" OR process.user contains "ITAdmin"

• Scenario: Legitimate software deployment using Remcos as part of a configuration management tool like SCCM
  Filter/Exclusion: process.name != "Remcos.exe" OR process.parent.name == "msiexec.exe" OR process.command_line contains "SCCM"

• Scenario: User running a legitimate remote support tool that uses Remcos as a backend component
  Filter/Exclusion: process.name != "Remcos.exe" OR process.parent.name == "Remote Support Tool.exe" OR process.user contains "SupportUser"