This hunt targets the presence of known Remcos Remote Access Trojan indicators, which adversaries deploy to establish persistent, high-privilege control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy RAT infections early, preventing lateral movement and data exfiltration before the malware can fully establish its foothold in the environment.
Malware Family: Remcos Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 216[.]9[.]224[.]130:14644 | botnet_cc | 2026-09-26 | 100% |
| ip:port | 172[.]94[.]46[.]114:1014 | botnet_cc | 2026-09-26 | 100% |
| ip:port | 128[.]90[.]123[.]244:2015 | botnet_cc | 2026-09-26 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["172.94.46.114", "128.90.123.244", "216.9.224.130"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.94.46.114", "128.90.123.244", "216.9.224.130"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy RDP Client Updates: The Remcos IOCs often include specific file paths or hashes associated with older RDP client binaries or helper DLLs. In environments where IT departments maintain legacy Windows 7/8 workstations or use third-party RDP clients (like Royal TS or mRemoteNG) that bundle similar components, these files may reside in C:\Program Files\ or user profile directories.
C:\Program Files\Royal TS\, C:\Program Files (x86)\mRemoteNG\) or files owned by known service accounts (e.g., svc_rdp_update) if the hash matches a known benign version.Scheduled Maintenance Jobs for Remote Desktop Services: Some enterprise environments use scheduled tasks to clean up or update RDP session files, which may temporarily create or modify files matching the Remcos IOC patterns (e.g., rdpclip.exe or specific cache files). If the IOC targets a specific executable name that is also used by a custom internal tool for RDP session management, this can trigger false positives.
Task Scheduler service (svchost.exe with TasksSched parameter) or specifically exclude paths under C:\Windows\System32\Tasks\ if the IOC is path-based.Development and Testing Environments: Developers or QA engineers may run Remcos or similar RDP-based malware samples in isolated lab environments or VMs to test detection coverage. If these labs are not fully segmented from the production network or if their file systems are mounted/shared, the IOCs can appear in shared drives or backup snapshots.
env=lab, env=dev, or role=qa