ThreatFox: Remcos IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known Remcos Remote Access Trojan indicators, which adversaries deploy to establish persistent, stealthy control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected systems before the malware can be leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`128[.]90[.]103[.]193:2015`	botnet_cc	2026-09-25	100%
ip:port	`43[.]156[.]187[.]96:2404`	botnet_cc	2026-09-25	100%
ip:port	`176[.]126[.]114[.]42:2404`	botnet_cc	2026-09-25	100%
ip:port	`172[.]111[.]163[.]171:65070`	botnet_cc	2026-09-25	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["176.126.114.42", "128.90.103.193", "172.111.163.171", "43.156.187.96"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.126.114.42", "128.90.103.193", "172.111.163.171", "43.156.187.96"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Remcos

False Positive Guidance

Remote Desktop Administration via RDP Clients: Legitimate IT support or remote workers often use third-party RDP clients (such as Microsoft Remote Desktop, Royal TS, or mstsc.exe) to connect to servers. Remcos is a Remote Access Trojan (RAT) that frequently masquerades as standard RDP traffic or uses similar port 3389 connections. If the IOC includes specific RDP handshake patterns or known RDP client hashes, legitimate administrative sessions will trigger the alert.
- Filter/Exclusion: Exclude connections originating from known administrative subnets (e.g., 10.0.10.0/24) or processes with verified digital signatures from Microsoft or major RDP client vendors (e.g., Royal TS, TeamViewer).
Scheduled Backup or Maintenance Jobs: Enterprise environments often run scheduled tasks (via Task Scheduler or cron) for backups, log rotation, or database maintenance. These jobs may execute scripts or binaries that match the file hashes or command-line arguments in the Remcos IOC set, especially if the IOCs include generic script execution patterns or common utility names.
- Filter/Exclusion: Exclude processes spawned by Task Scheduler (svchost.exe with specific task IDs) or known backup agents (e.g., Veeam, Commvault, Windows Server Backup) by filtering on the parent process name or the specific scheduled task name.
Software Update and Patch Management Agents: Patch management tools (such as SCCM, WSUS, or Ansible) frequently download and execute installers or update packages. If the Remcos IOCs include specific file hashes or download URLs that coincide with common software update endpoints or installer binaries, these legitimate updates may be flagged.
- Filter/Exclusion: Exclude network connections to known software update repositories (e.g., *.update.microsoft.com, internal WSUS servers) and processes associated with