ThreatFox: Remcos IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Indicators of Compromise (IOCs) associated with the Remcos Remote Access Trojan, which adversaries deploy to establish persistent, interactive control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy RAT infections before they are leveraged for lateral movement or data exfiltration, thereby reducing the dwell time of high-severity threats within the environment.

IOC Summary

Malware Family: Remcos Total IOCs: 10 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["107.172.132.42"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["107.172.132.42"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["pulsa188slot.co", "trungnguyen.co.za", "kolaybet.club", "kuncislothoki.co", "kuwin.wang", "qh88.es", "api.go8.plus", "api.qh88eu.com", "clipmagic.co"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

• Scenario: A legacy internal application or third-party SDK (e.g., an old Java-based reporting tool or a specific .NET wrapper) bundles a shared library or DLL that shares a specific hash or filename with one of the Remcos IOCs due to outdated build processes or generic naming conventions (e.g., core.dll or helper.sys).
  • Filter/Exclusion: Exclude alerts where the process path resides in known application directories (e.g., C:\Program Files\InternalApps\LegacyReport\) and the parent process is a known service executable (e.g., w3wp.exe or java.exe) rather than an interactive user process.
• Scenario: An IT administrator manually copies a Remcos-related sample file (e.g., remcos_loader.exe) to a network share or staging folder for analysis, testing, or distribution to other team members, triggering file creation or hash-based detections on the file server or client workstations.
  • Filter/Exclusion: Exclude detections where the file path contains keywords like \Staging\, \Analysis\, or \Temp\ and the user account belongs to a specific security or IT admin group (e.g., SEC-Admins or IT-Support).
• Scenario: A scheduled maintenance job or deployment script (e.g., a PowerShell script run by Task Scheduler or Ansible) extracts or writes a configuration file or binary component that matches an IOC hash because it is a generic utility component (like a specific version of libcurl or a common logging library) used across multiple internal tools.
  • Filter/Exclusion: Exclude alerts where the parent process is svchost.exe (specifically the Task Scheduler service) or powershell.exe invoked by a known service account, and the file location is within a system temp directory (`C:\Windows\Temp