This hypothesis targets the presence of known Remcos Remote Access Trojan indicators, which adversaries deploy to establish persistent, stealthy control over compromised endpoints for data exfiltration and lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical because Remcos is frequently used in targeted phishing campaigns and ransomware pre-staging, allowing the SOC to identify and isolate infected assets before the malware can fully establish its foothold in the environment.
Malware Family: Remcos Total IOCs: 11 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 184[.]75[.]208[.]10:49006 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 198[.]135[.]55[.]102:2404 | botnet_cc | 2026-09-07 | 100% |
| ip:port | 31[.]57[.]184[.]17:2404 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 93[.]114[.]183[.]155:2404 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 147[.]124[.]214[.]11:2404 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 130[.]12[.]182[.]176:2404 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 130[.]12[.]182[.]176:3000 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 130[.]12[.]182[.]216:2404 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 102[.]220[.]161[.]75:2404 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 102[.]220[.]161[.]59:2404 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 43[.]228[.]157[.]194:2404 | botnet_cc | 2026-09-07 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["102.220.161.75", "93.114.183.155", "147.124.214.11", "130.12.182.176", "198.135.55.102", "43.228.157.194", "130.12.182.216", "102.220.161.59", "184.75.208.10", "31.57.184.17"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.161.75", "93.114.183.155", "147.124.214.11", "130.12.182.176", "198.135.55.102", "43.228.157.194", "130.12.182.216", "102.220.161.59", "184.75.208.10", "31.57.184.17"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom internal build agent or CI/CD runner that shares a binary hash or file path with a known Remcos IOCs due to similar compilation flags or naming conventions (e.g., build_agent.exe or runner.dll in a standard C:\Program Files\ location).
msbuild.exe, dotnet.exe, or java.exe) or where the file path resides in a designated CI/CD directory (e.g., C:\Jenkins\workspace\ or C:\AzureDevOps\).Scenario: An IT administrator manually installs a legacy Java-based application or a specific version of a third-party RMM (Remote Monitoring and Management) tool that includes a helper component matching one of the Remcos IOCs (e.g., a helper.exe or service.dll in the application’s install directory).
C:\Program Files\Java\, C:\Program Files (x86)\NinjaOne\, or C:\Program Files (x86)\Dell\) and verify the digital signature matches the vendor’s expected certificate.Scenario: A security engineer or QA team runs a controlled malware sample or a Remcos-specific test binary in an isolated lab environment or a dedicated “Test” OU to validate detection coverage before promoting the rule to production.
--test-mode or --validation) and the parent process is a known test harness (e.g