ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt targets the presence of known Remcos Remote Access Trojan indicators, which adversaries deploy to establish persistent, stealthy control over compromised endpoints for data exfiltration and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected systems before the malicious RAT can fully execute its payload or expand its foothold within the network.

IOC Summary

Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["87.120.244.219", "204.10.160.243"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["87.120.244.219", "204.10.160.243"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["inspectormanna.duckdns.org", "postdatak.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

• Legacy Application Maintenance via Scheduled Tasks: An IT operations team uses a scheduled task (e.g., Task Scheduler or cron) to run a legacy Java-based reporting tool that bundles the Remcos DLLs for compatibility with older .NET frameworks. The tool is executed from a standard C:\Program Files\ path but matches the hash or filename IOC.
  • Filter/Exclusion: Exclude alerts where the process path contains \Program Files\ or \Program Files (x86)\ and the parent process is svchost.exe (Task Scheduler service) or schtasks.exe, and the file extension is .dll or .jar rather than .exe.
• Third-Party RMM Agent Updates: A Remote Monitoring and Management (RMM) agent (e.g., ConnectWise Automate, Datto RMM, or N-able) performs a background update or service restart that temporarily writes Remcos-related components to the system temp folder or a vendor-specific directory before cleaning up. The IOC matches the temporary file location or the specific service name.
  • Filter/Exclusion: Exclude alerts where the file path contains vendor-specific directories such as \ConnectWise\, \Datto\, or \N-able\, or where the parent process is the known RMM agent executable (e.g., cwagent.exe, dattoagent.exe).
• Development and QA Environments: Developers or QA engineers run Remcos-based test applications or demo builds in isolated development VMs or containers to verify integration with a new API. These environments often run from non-standard paths like C:\Dev\ or C:\QA\ and may use debug versions of the Remcos binaries.
  • Filter/Exclusion: Exclude alerts for hosts tagged with env=dev, env=qa, or role=development