This hypothesis targets the presence of known Indicators of Compromise (IOCs) associated with the Remcos remote access trojan, which adversaries deploy to establish persistent, stealthy control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected systems before the attacker leverages the RAT for lateral movement, data exfiltration, or further payload delivery.
Malware Family: Remcos Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 193[.]124[.]131[.]235:2409 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 193[.]124[.]131[.]235:2407 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 193[.]124[.]131[.]235:2406 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 193[.]124[.]131[.]235:3398 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 193[.]124[.]131[.]235:2405 | botnet_cc | 2026-09-19 | 100% |
| ip:port | 193[.]124[.]131[.]235:9987 | botnet_cc | 2026-09-19 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["193.124.131.235"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.124.131.235"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses the Remcos client (or a custom wrapper script invoking its underlying components) to perform remote desktop support or screen sharing during a planned maintenance window. The RemcosClient.exe process or its associated hash matches the IOC list.
mstsc.exe, TeamViewer.exe, AnyDesk.exe) or where the user belongs to the Service_DevOps security group. Additionally, exclude if the event occurs during a scheduled maintenance window defined in the CMDB.Scenario: An IT administrator installs a legacy application that bundles the Remcos service (RemcosService.exe) for background data synchronization or licensing checks. The service starts at boot and matches the service name or binary hash IOC.
C:\Program Files\LegacyApp\) and the service is registered under a known vendor name. Verify the digital signature matches the expected vendor certificate before excluding.Scenario: A security team deploys a Remcos instance in a dedicated “honeypot” or canary host to monitor for lateral movement or credential theft. The IOCs (hashes, registry keys, or service names) are intentionally present and active.
canary-01.corp.local). Alternatively, tag these hosts in the asset inventory with a Honeypot label and filter based on that tag in the SIEM.Scenario: A software update or patch for a third-party remote access tool (e.g., ScreenConnect or ConnectWise Control)