ThreatFox: Remcos IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving the Remcos remote access trojan by monitoring for eight specific indicators of compromise within Azure Sentinel. Proactive hunting for these signatures is critical to uncover stealthy post-compromise operations that may evade standard alerting mechanisms and facilitate early containment of potential lateral movement or data exfiltration attempts.

IOC Summary

Malware Family: Remcos Total IOCs: 8 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["103.114.217.108", "217.60.195.34", "34.41.139.193", "206.123.137.133", "209.54.101.171", "152.44.34.91"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.114.217.108", "217.60.195.34", "34.41.139.193", "206.123.137.133", "209.54.101.171", "152.44.34.91"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["www.ambiopharmconsultingltdbackup.com", "advancehunter.4nmn.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Backup Script Execution

  • Context: A nightly scheduled task (e.g., Task Scheduler on Windows Server) runs a PowerShell script to archive logs. The script utilizes the specific hash or filename of a legitimate backup utility that matches one of the Remcos IOCs, triggering an alert when the service account (NT SERVICE\Backup) executes it.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name and Account. Exclude alerts where Process_Name equals “PowerShell.exe” AND Account_Name contains “NT SERVICE” or “System”, specifically when the execution path is within a known backup directory (e.g., C:\Program Files\BackupAgent\Scripts).

• Scenario: Endpoint Protection Agent Communication

  • Context: The organization uses Microsoft Defender for Endpoint or CrowdStrike. During a policy update cycle, the agent’s communication module establishes a connection to an internal management server using a port and protocol signature that overlaps with Remcos’ C2 beaconing behavior (specifically matching the IOCs related to HTTP/HTTPS traffic patterns).
  • Suggested Filter/Exclusion: Implement a network-based exclusion. Filter out alerts where Destination_IP belongs to the corporate internal CIDR range (e.g., 10.x.x.x) and the Process_Name matches known security agents like “MsMpEng.exe” or “csagent.exe”.

• Scenario: Software Deployment via SCCM/Intune

  • Context: The IT team deploys a new patch using Microsoft Endpoint Configuration Manager (SCCM). The deployment agent (ccmexec.exe) spawns a child process to verify installation integrity.