ThreatFox: Remcos IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving the Remcos remote administration tool by monitoring for specific indicators of compromise known to facilitate command-and-control communications and data exfiltration. A proactive hunt is essential in Azure Sentinel to rapidly detect early-stage infections and prevent potential lateral movement or credential theft before the threat establishes a persistent foothold within the environment.

IOC Summary

Malware Family: Remcos Total IOCs: 12 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`131[.]226[.]2[.]95:40038`	botnet_cc	2026-08-31	100%
ip:port	`147[.]124[.]223[.]53:2404`	botnet_cc	2026-08-31	100%
ip:port	`213[.]152[.]162[.]29:13309`	botnet_cc	2026-08-31	100%
ip:port	`123[.]253[.]32[.]82:5025`	botnet_cc	2026-08-31	75%
ip:port	`217[.]60[.]103[.]4:2404`	botnet_cc	2026-08-31	75%
ip:port	`172[.]94[.]111[.]195:2404`	botnet_cc	2026-08-31	75%
ip:port	`192[.]159[.]99[.]121:2580`	botnet_cc	2026-08-31	100%
ip:port	`192[.]159[.]99[.]121:25800`	botnet_cc	2026-08-31	100%
ip:port	`131[.]226[.]2[.]95:4920`	botnet_cc	2026-08-31	100%
ip:port	`163[.]245[.]199[.]241:2404`	botnet_cc	2026-08-31	100%
ip:port	`172[.]111[.]163[.]174:65070`	botnet_cc	2026-08-31	100%
ip:port	`172[.]111[.]163[.]162:65070`	botnet_cc	2026-08-31	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["172.94.111.195", "192.159.99.121", "123.253.32.82", "163.245.199.241", "172.111.163.174", "147.124.223.53", "131.226.2.95", "217.60.103.4", "213.152.162.29", "172.111.163.162"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.94.111.195", "192.159.99.121", "123.253.32.82", "163.245.199.241", "172.111.163.174", "147.124.223.53", "131.226.2.95", "217.60.103.4", "213.152.162.29", "172.111.163.162"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Remcos

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Remcos IOCs detection rule in an enterprise environment:

Scenario: Legitimate Remote Management Tools Mimicking Remcos Behavior
- Context: Enterprise IT departments often deploy remote administration tools like Microsoft System Center Configuration Manager (SCCM), TeamViewer, or AnyDesk. These tools frequently establish persistent connections, inject processes into explorer.exe or specific service hosts, and utilize similar network ports (e.g., 80/443 with custom payloads) that overlap with Remcos’ known IOCs.
- Filter/Exclusion: Create a whitelist exclusion for the specific process names and SHA25 hashes of authorized remote management tools. For example: Exclude if Process Name in ('ccmexec.exe', 'TeamViewer_Service.exe', 'AnyDeskService.exe') AND User Account is 'System' or 'Domain Admins'.
Scenario: Scheduled Backup Jobs Triggering Network Signatures
- Context: Automated backup solutions such as Veeam Backup & Replication, Rubrik, or Acronis Cyber Protect often run scheduled tasks that initiate outbound connections to cloud storage or central management servers. These jobs may generate network traffic patterns and file modifications (e.g., creating temporary config files in %TEMP%) that match the IOCs associated with Remcos’ command-and-control communication.
- Filter/Exclusion: Exclude alerts generated during known maintenance windows or specific scheduled task executions. Filter logic: Exclude if Source Process is 'VeeamTransport.exe' OR 'AcronisBackupService.exe' AND Event Time falls within the defined backup window (e.g., 02:00–04:00 UTC).
Scenario: Software Deployment and Patching Activities
- Context: During