ThreatFox: Remcos IOCs

Hunt Hypothesis

This detection rule identifies the presence of Remcos Remote Access Trojan indicators within your Azure Sentinel environment to uncover potential unauthorized remote access and data exfiltration activities. Proactively hunting for these specific IOCs is critical because Remcos enables adversaries to establish persistent command-and-control channels that can silently compromise sensitive assets before traditional alerts trigger.

IOC Summary

Malware Family: Remcos Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["207.180.29.217", "207.180.29.85"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["207.180.29.217", "207.180.29.85"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Enterprise Endpoint Protection Scans

  • Context: Security suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently download threat intelligence feeds or perform signature updates that match Remcos hash signatures. These scans often generate network traffic to known update servers that overlap with Remcos C2 domains.
  • Filter/Exclusion: Create a whitelist exception for the specific process paths of your EDR agents (e.g., C:\Program Files\CrowdStrike\fs_qc.exe or C:\Windows\System32\DefenderSvc.exe) when they initiate outbound connections to known update domains. Exclude these processes from triggering the rule if the destination IP is within the organization’s trusted cloud provider CIDR ranges (e.g., AWS, Azure).

• Scenario: Scheduled Backup and Sync Operations

  • Context: Automated backup solutions such as Veeam, Rubrik, or Microsoft OneDrive for Business often utilize background services that establish persistent connections to external storage nodes. The network patterns of these sync jobs can mimic the Remcos beaconing behavior, particularly if they use similar port ranges (e.g., TCP 443) and periodic connection intervals.
  • Filter/Exclusion: Implement a filter based on Scheduled Task names or specific service accounts. Exclude alerts where the initiating process is OneDrive.exe, VeeamTransportService.exe, or runs under the NT SERVICE\ context during off-peak hours (e.g., 02:00–05:00 local time).

• Scenario: Remote Desktop and Collaboration Tools

  • Context: Administrative tasks involving