ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Remcos remote access trojans by identifying specific indicators of compromise such as known malicious hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical to detect early-stage lateral movement and command-and-control communications before the malware establishes persistent footholds within the enterprise environment.

IOC Summary

Malware Family: Remcos Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["185.236.203.99", "185.149.24.6"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.236.203.99", "185.149.24.6"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Policy Updates via GPO

  • Scenario: During scheduled Group Policy Object (GPO) refreshes, the IT team pushes updated definitions and configuration scripts to endpoints. If the Remcos IOCs include specific file paths or registry keys related to remote management agents, a legitimate update from tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Intune may trigger the rule when writing these files during the maintenance window.
  • Filter/Exclusion: Exclude events where the ProcessName is ccmexec.exe (ConfigMgr) or MsDeployAgent.exe, and the ParentProcessName is svchost.exe running under the NT AUTHORITY\SYSTEM account, specifically during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Automated Patch Management Scans

  • Scenario: Enterprise patch management tools often perform deep system scans that involve creating temporary files or modifying registry keys to verify agent health. Tools like Ivanti Neurons, ManageEngine Endpoint Central, or SolarWinds Patch Manager may generate file artifacts matching the Remcos IOCs while verifying the integrity of installed agents on thousands of workstations simultaneously.
  • Filter/Exclusion: Create a filter to suppress alerts where the InitiatingProcess is known patch management binaries (e.g., IvantiAgent.exe, SolarWindsPatchService.exe) and the event source is restricted to the “Software Update” or “Health Check” job categories within the tool’s dashboard.

• Scheduled Backup and Snapshot Operations

  • Scenario: Enterprise backup solutions frequently create