ThreatFox: Remcos IOCs

Hunt Hypothesis

This rule detects the presence of known indicators of compromise associated with the Remcos remote access trojan, a tool frequently deployed by threat actors to establish persistent backdoors and exfiltrate data. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the adversary leverages the RAT for lateral movement or further payload delivery.

IOC Summary

Malware Family: Remcos Total IOCs: 12 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["172.111.150.134", "155.103.69.239", "103.83.86.178", "160.250.131.245", "102.220.161.74", "130.12.182.185", "36.255.97.50"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.111.150.134", "155.103.69.239", "103.83.86.178", "160.250.131.245", "102.220.161.74", "130.12.182.185", "36.255.97.50"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["karouts3ustyer5.duckdns.org", "karouts3ustyer1.duckdns.org", "karouts3ustyer2.duckdns.org", "karouts3ustyer3.duckdns.org", "karouts3ustyer4.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

• Legitimate Remote Support Sessions: IT support teams frequently use commercial remote control software that shares similar behavioral fingerprints or file paths with Remcos (e.g., TeamViewer.exe, AnyDesk.exe, or LogMeIn.exe running from non-standard locations like C:\Users\Public\ or C:\Temp\). If the hunt package flags specific executable names or hash values that overlap with these legitimate tools, it can trigger false positives.

  • Filter/Exclusion: Exclude processes where the parent process is a known IT management agent (e.g., SCCM.exe, WSUS, or IntuneAgent.exe) or where the executable path resides in standard vendor directories (e.g., C:\Program Files\TeamViewer\, C:\Program Files (x86)\AnyDesk\).

• Software Update and Patching Cycles: Enterprise patch management systems (e.g., SCCM, WSUS, or Chocolatey) often download and execute installer packages or temporary binaries in user profile directories or temp folders (%TEMP%, %APPDATA%) before moving them to the installation directory. If the Remcos IOCs include generic file extensions (e.g., .exe in temp) or specific hash values that match common installer components, these routine updates may be flagged.

  • Filter/Exclusion: Exclude events where the process creation is initiated by a known patching service (e.g., CCMEXEC.EXE, WUAHSELFHOST.EXE, or choco.exe) and the working directory is within a standard software distribution path (e.g., C:\Windows\CCM\ or C:\ProgramData\Chocolatey\).

• Developer Build and Test Environments: Developers and QA engineers often compile, run, and test applications from local drives or network shares, sometimes using portable versions of tools or custom-built