This detection rule identifies adversary activity linked to the Remcos remote access trojan by monitoring for specific indicators of compromise such as unique file hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical because Remcos enables attackers to establish persistent command-and-control channels that can facilitate data exfiltration and lateral movement within the enterprise environment.
Malware Family: Remcos Total IOCs: 22 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | oceanking.noip.at | botnet_cc | 2026-08-10 | 75% |
| domain | dunday.mytunnel.org | botnet_cc | 2026-08-10 | 75% |
| ip:port | 87[.]120[.]244[.]219:19601 | botnet_cc | 2026-08-10 | 75% |
| domain | anilmut.ydns.eu | botnet_cc | 2026-08-10 | 75% |
| domain | www.xmmtbxbackup2.com | botnet_cc | 2026-08-10 | 75% |
| domain | www.xmmtbx.com | botnet_cc | 2026-08-10 | 75% |
| domain | www.xmmtbxbackup.com | botnet_cc | 2026-08-10 | 75% |
| domain | www.xmmtbxbackup1.com | botnet_cc | 2026-08-10 | 75% |
| ip:port | 217[.]60[.]195[.]236:2404 | botnet_cc | 2026-08-10 | 100% |
| ip:port | 87[.]120[.]244[.]219:17598 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 161[.]97[.]162[.]13:8899 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 185[.]242[.]4[.]122:37393 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 209[.]127[.]35[.]195:3533 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 109[.]248[.]148[.]247:32734 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 86[.]106[.]84[.]151:37393 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 31[.]13[.]190[.]82:37393 | botnet_cc | 2026-08-10 | 75% |
| domain | kindjurt.myddns.me | botnet_cc | 2026-08-10 | 75% |
| ip:port | 37[.]120[.]146[.]146:37393 | botnet_cc | 2026-08-10 | 75% |
| domain | onboard.radiantfluxstudio.com | botnet_cc | 2026-08-10 | 75% |
| ip:port | 46[.]183[.]218[.]151:37393 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 185[.]14[.]92[.]102:443 | botnet_cc | 2026-08-10 | 100% |
| ip:port | 196[.]251[.]121[.]163:14555 | botnet_cc | 2026-08-10 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["161.97.162.13", "46.183.218.151", "87.120.244.219", "109.248.148.247", "217.60.195.236", "196.251.121.163", "209.127.35.195", "86.106.84.151", "185.242.4.122", "31.13.190.82", "37.120.146.146", "185.14.92.102"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["161.97.162.13", "46.183.218.151", "87.120.244.219", "109.248.148.247", "217.60.195.236", "196.251.121.163", "209.127.35.195", "86.106.84.151", "185.242.4.122", "31.13.190.82", "37.120.146.146", "185.14.92.102"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["oceanking.noip.at", "dunday.mytunnel.org", "anilmut.ydns.eu", "www.xmmtbxbackup2.com", "www.xmmtbx.com", "www.xmmtbxbackup.com", "www.xmmtbxbackup1.com", "kindjurt.myddns.me", "onboard.radiantfluxstudio.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: IT Admin Executing Scheduled Backup Scripts via PowerShell
PowerShell.exe to query remote systems or manage file integrity might trigger the Remcos IOCs if the script utilizes specific .NET assemblies or network ports commonly associated with Remcos (e.g., port 5804).Backup, Sync, or Integrity and the parent process is a known scheduled task service (Task Scheduler Service).
ProcessName = "powershell.exe" AND CommandLine CONTAINS "Backup" AND ParentProcessName = "svchost.exe"Scenario: Endpoint Protection Agent Performing Cloud-Based Threat Intelligence Updates
FalconSensor.exe, MsMpEng.exe) and the destination IP belongs to the vendor’s CDN range.
ParentProcessName IN ("FalconSensor.exe", "MsMpEng.exe") AND DestinationIP IN (Vendor_Cloud_Range)Scenario: Software Deployment via SCCM or Intune Pushing .NET Applications