This hunt detects adversary activity consistent with the Remcos remote access trojan by identifying matches against its known indicators of compromise within Azure Sentinel logs. Proactively hunting for these signatures is critical to rapidly identify and contain potential data exfiltration or command-and-control communications before they escalate into a full-scale breach.
Malware Family: Remcos Total IOCs: 17 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 204[.]44[.]69[.]214:14646 | botnet_cc | 2026-07-15 | 75% |
| ip:port | 192[.]255[.]195[.]147:14645 | botnet_cc | 2026-07-15 | 75% |
| ip:port | 124[.]198[.]132[.]119:5220 | botnet_cc | 2026-07-15 | 75% |
| ip:port | 103[.]11[.]41[.]10:62452 | botnet_cc | 2026-07-15 | 75% |
| ip:port | 103[.]11[.]41[.]10:10443 | botnet_cc | 2026-07-15 | 75% |
| domain | pajp.oragh8kaso1.com | botnet_cc | 2026-07-15 | 75% |
| domain | gros59kalmso1.duckdns.org | botnet_cc | 2026-07-15 | 75% |
| domain | gros59kalmso2.duckdns.org | botnet_cc | 2026-07-15 | 75% |
| domain | metromachine[.]4nmn.com | botnet_cc | 2026-07-15 | 75% |
| domain | armcobarriersuppliers.duckdns.org | botnet_cc | 2026-07-15 | 75% |
| domain | armcobarriersuppliersbk.duckdns.org | botnet_cc | 2026-07-15 | 75% |
| ip:port | 102[.]220[.]160[.]104:2404 | botnet_cc | 2026-07-15 | 75% |
| ip:port | 161[.]248[.]179[.]182:37171 | botnet_cc | 2026-07-15 | 75% |
| ip:port | 130[.]12[.]182[.]47:2404 | botnet_cc | 2026-07-15 | 75% |
| ip:port | 194[.]59[.]31[.]232:2404 | botnet_cc | 2026-07-15 | 75% |
| ip:port | 165[.]227[.]80[.]236:443 | botnet_cc | 2026-07-15 | 75% |
| ip:port | 160[.]25[.]72[.]34:2404 | botnet_cc | 2026-07-15 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["102.220.160.104", "160.25.72.34", "204.44.69.214", "103.11.41.10", "165.227.80.236", "124.198.132.119", "130.12.182.47", "192.255.195.147", "194.59.31.232", "161.248.179.182"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.160.104", "160.25.72.34", "204.44.69.214", "103.11.41.10", "165.227.80.236", "124.198.132.119", "130.12.182.47", "192.255.195.147", "194.59.31.232", "161.248.179.182"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["pajp.oragh8kaso1.com", "gros59kalmso1.duckdns.org", "gros59kalmso2.duckdns.org", "metromachine.4nmn.com", "armcobarriersuppliers.duckdns.org", "armcobarriersuppliersbk.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Endpoint Protection Scanning of Quarantine Archives
C:\ProgramData\Microsoft\Windows Defender\Scans\Quarantine or specific CrowdStrike C:\CrowdStrike\Logs) and filter out processes initiated by the EDR service account (e.g., svc-crowdstrike).Scheduled Vulnerability Assessment Scans
svc-tenable or QualysAgent) and restrict the rule trigger to exclude specific scheduled time windows (e.g., 02:00–04:00 UTC) where these scans are known to run.Software Deployment via Configuration Management