ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt targets adversaries deploying the Remcos remote access trojan by actively searching for its specific indicators of compromise across the Azure Sentinel environment. Proactively hunting for these signals is critical to identify early-stage infections and prevent potential data exfiltration or lateral movement before the malware establishes deep persistence within the network.

IOC Summary

Malware Family: Remcos Total IOCs: 12 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["209.54.103.181", "23.95.103.253"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["209.54.103.181", "23.95.103.253"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["catground1957.casacam.net", "www.jahstandclassprojectbackup3.com", "www.jahstandclassproject.com", "www.jahstandclassprojectbackup.com", "www.jahstandclassprojectbackup1.com", "www.jahstandclassprojectbackup2.com", "www.ikukuomaproject.com", "www.ikukuomaprojectbackup.com", "www.ikukuomaprojectbackup1.com", "www.ikukuomaprojectbackup2.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Legitimate Admin Deployment via SCCM/Intune

  • Context: System Administrators frequently deploy the “Remos” remote management tool (often confused with Remcos due to naming similarity) or a similarly named internal utility using Microsoft Endpoint Configuration Manager (SCCM) or Intune. The deployment process triggers file creation and network connections that match the rule’s IOCs.
  • Filter/Exclusion: Exclude processes originating from ccmsetup.exe (SCCM) or DeviceCensusWorker.exe (Intune) where the parent process is a trusted service account (e.g., DOMAIN\SCCM-Admin). Additionally, filter out file hashes that match the known good hash of the internal “Remos” tool.

• Scenario: Scheduled Backup Jobs Utilizing Remcos-like Signatures

  • Context: A nightly scheduled task runs a custom backup script named remos_backup.exe (or similar) which establishes persistent network connections to an on-premise storage server. The script’s digital signature and network behavior overlap significantly with the Remcos IOCs, triggering alerts during the maintenance window.
  • Filter/Exclusion: Create a time-based exclusion for the rule between 02:00 and 04:00 local time on weekdays. Furthermore, exclude any process execution where the CommandLine contains specific backup keywords (e.g., -backup, --sync) and the file path resides in a dedicated backup directory like C:\Program Files\EnterpriseBackup\.

• Scenario: Development Environment CI/CD Pipeline Execution

  • Context: In development zones, Jenkins or GitLab runners execute build pipelines that clone repositories containing