ThreatFox: Remcos IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Remcos remote access trojan within the Azure environment to establish persistent command and control channels using known indicators of compromise. Proactive hunting for these specific IOCs is critical because early detection of Remcos activity allows the SOC team to mitigate data exfiltration risks before the malware can fully establish its foothold on compromised endpoints.

IOC Summary

Malware Family: Remcos Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["138.226.237.250", "88.216.73.83", "103.11.41.20"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["138.226.237.250", "88.216.73.83", "103.11.41.20"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Protection Scanning of Quarantine Folders

  • Scenario: The EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender) performs a scheduled deep scan of the C:\ProgramData\Quarantine directory. This folder often contains archived malware samples from previous incidents, including historical Remcos variants used for training or signature updates. When the scanner reads these files, it triggers the IOCs associated with the sample’s internal structure.
  • Filter/Exclusion: Exclude file paths containing C:\ProgramData\Quarantine and C:\Windows\System32\com\CrowdStrike. Additionally, filter out events where the parent process is the EDR service executable (e.g., csagent.exe, MsMpEng.exe) rather than a user-facing application.

• IT Admin Deployment of Security Baseline Scripts

  • Scenario: System administrators use PowerShell scripts to deploy security baselines across the fleet via SCCM or Intune. These scripts frequently download and execute temporary configuration files that include known Remcos IOCs (such as specific registry keys for persistence or network beacon URLs) to validate connectivity before pushing updates.
  • Filter/Exclusion: Create an exclusion rule for processes launched by powershell.exe where the command line arguments contain keywords like -File, -ExecutionPolicy Bypass, and paths pointing to the software distribution point (e.g., \\server\share\scripts). Whitelist the specific hash of the deployment script itself.

• Scheduled Antivirus Signature Updates

  • Scenario: During off-hours, the enterprise AV solution (e.g., Symantec Endpoint Protection or Sophos) downloads and installs a new definition