ThreatFox: Remcos IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis targets adversary behavior involving the deployment of the Remcos remote access trojan by searching for eight specific indicators of compromise across network and endpoint logs. Proactively hunting for these signatures in Azure Sentinel is critical because early detection of Remcos activity prevents long-term credential theft and lateral movement before the malware establishes persistent command-and-control channels.

IOC Summary

Malware Family: Remcos Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`46[.]151[.]182[.]209:8080`	botnet_cc	2026-07-07	75%
ip:port	`198[.]135[.]48[.]206:2404`	botnet_cc	2026-07-07	75%
ip:port	`185[.]149[.]24[.]6:2406`	botnet_cc	2026-07-07	100%
ip:port	`89[.]106[.]83[.]79:7312`	botnet_cc	2026-07-07	75%
ip:port	`69[.]166[.]206[.]151:7022`	botnet_cc	2026-07-07	75%
ip:port	`209[.]54[.]103[.]155:14646`	botnet_cc	2026-07-07	75%
ip:port	`155[.]103[.]69[.]30:14643`	botnet_cc	2026-07-07	75%
ip:port	`103[.]11[.]41[.]10:7145`	botnet_cc	2026-07-07	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["185.149.24.6", "198.135.48.206", "69.166.206.151", "209.54.103.155", "89.106.83.79", "46.151.182.209", "103.11.41.10", "155.103.69.30"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.149.24.6", "198.135.48.206", "69.166.206.151", "209.54.103.155", "89.106.83.79", "46.151.182.209", "103.11.41.10", "155.103.69.30"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Remcos

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Detection and Response (EDR) Agent Updates
- Scenario: The EDR agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a scheduled definition update. During this process, the agent downloads and executes a new detection engine module that shares a specific file hash or network signature with one of the Remcos IOCs. This often occurs during early morning maintenance windows across the entire fleet.
- Filter/Exclusion: Exclude alerts where the Process Name matches known EDR service executables (e.g., csagent.exe, MsMpEng.exe, SentinelOneAgent.exe) and the User Account is a system account (e.g., NT AUTHORITY\SYSTEM or LocalService).
IT Administration: Patch Management Deployment
- Scenario: The IT Operations team deploys a critical security patch using a configuration management tool like Microsoft SCCM (ConfigMgr) or Ivanti. The deployment package includes a custom script that extracts and runs a diagnostic utility. This utility, used to verify patch integrity, generates network traffic or file artifacts matching the Remcos “command and control” beacon IOCs.
- Filter/Exclusion: Create an exclusion for alerts originating from specific SCCM/Ivanti Management Point servers (by IP range) where the Parent Process is identified as the deployment orchestrator (e.g., ccmexec.exe, IvAntiAgent.exe) and the execution time falls within the defined “Patch Tuesday” maintenance window.
Software Development: CI/CD Pipeline Execution
- Scenario: A DevOps pipeline running on a build server