ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt detects adversary behavior where a Remote Access Trojan (Remcos) is deployed via phishing vectors to establish persistence and enable remote command execution for data exfiltration. The SOC team should proactively hunt for these indicators in Azure Sentinel because Remcos’s ability to maintain long-term access allows attackers to silently extract sensitive information before detection, necessitating early identification of its specific IOCs to prevent widespread compromise.

IOC Summary

Malware Family: Remcos Total IOCs: 2 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["mbcasesores.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remcos
let malicious_urls = dynamic(["https://mbcasesores.com/tap/BBVA_pdf.zip"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

False Positive Scenarios for “ThreatFox: Remcos IOCs” Rule

• Scenario 1: Enterprise Patch Management Deployment

  • Context: The organization uses Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons to deploy a new security update. These tools often download and execute remote management agents that mimic the behavior of Remcos by establishing persistent connections, executing commands on endpoints, and exfiltrating inventory data to a central server.
  • Suggested Filter: Exclude processes originating from known patch management binaries (e.g., ccmsetup.exe, IvantiAgent.exe) when they connect to internal IP ranges or specific cloud update domains (e.g., *.microsoft.com, *.ivanti.com).

• Scenario 2: Scheduled Remote Administration via PowerShell

  • Context: A System Administrator runs a nightly scheduled job using Windows Task Scheduler to execute a custom PowerShell script (powershell.exe) that performs remote inventory collection and command execution across the fleet. This activity triggers the rule because Remcos is known for utilizing PowerShell for lateral movement and data exfiltration.
  • Suggested Filter: Create an exclusion based on the Process Name being powershell.exe combined with a Parent Process of svchost.exe (for Task Scheduler) or taskscheduler.exe, specifically when the command line contains internal script paths (e.g., \\fileserver\scripts\inventory.ps1).

• Scenario 3: Legitimate Remote Support Sessions

  • Context: The Helpdesk team utilizes BeyondTrust or TeamViewer to provide remote support. These tools establish persistent sessions that allow command execution and file transfer, which are core capabilities of the Remcos RAT. When a technician initiates a session from an internal jump box, the detection logic may