ThreatFox: Remcos IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the Remcos Remote Access Trojan by matching network and endpoint telemetry against known Indicators of Compromise (IOCs). A proactive hunt for these signals in Azure Sentinel is critical to rapidly isolate compromised systems before attackers establish persistent remote access capabilities for data exfiltration or lateral movement.

IOC Summary

Malware Family: Remcos Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["191.96.166.172"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["191.96.166.172"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["no.ahanresaan.ir"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: IT Admin Remote Support Sessions via TeamViewer or AnyDesk

  • Context: Helpdesk administrators frequently initiate remote sessions using tools like TeamViewer, AnyDesk, or Splashtop to troubleshoot user workstations. These tools often establish persistent background services and network connections that mimic the behavioral footprint of Remcos (a RAT), specifically regarding registry persistence keys and outbound traffic patterns.
  • Filter/Exclusion: Create an exclusion rule based on the specific Image Path or Process Name. Exclude processes where the executable path contains \Program Files\TeamViewer\, \Program Files\AnyDesk\, or \Program Files\Splashtop Enterprise\. Additionally, whitelist the specific hash values of these known-good executables.

• Scenario: Scheduled Backup and Monitoring Agents (Veeam / SolarWinds)

  • Context: Enterprise backup solutions like Veeam Agent or monitoring suites like SolarWinds NCM run scheduled jobs that install background services to monitor system health and manage data transfer. These agents often create registry keys under HKLM\Software and establish outbound connections to management servers, which can trigger the Remcos IOC logic regarding service installation and network communication.
  • Filter/Exclusion: Implement a filter based on User Context and Scheduled Task Name. Exclude events where the triggering user is a dedicated service account (e.g., DOMAIN\svc_backup_admin or DOMAIN\svc_monitoring) AND the parent process name matches known backup agents (VeeamAgent.exe, SolarWinds.Agent.exe).

• Scenario: Deployment of Endpoint Detection and Response (EDR) Agents

  ---