ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt targets the presence of known Remcos Remote Access Trojan indicators, which adversaries deploy to establish persistent, stealthy control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical because Remcos enables high-fidelity data exfiltration and lateral movement, allowing attackers to maintain long-term access without triggering standard behavioral detections.

IOC Summary

Malware Family: Remcos Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["45.9.150.176", "94.154.40.106"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.9.150.176", "94.154.40.106"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

• Scenario: A DevOps engineer uses the Remcos client (or a similar RDP/VNC wrapper that shares the same binary hash or process name) for remote troubleshooting during a scheduled maintenance window. The process is launched from a standard admin path like C:\Program Files\RemoteSupport\ and establishes a connection to a known internal jump host.

  • Filter/Exclusion: Exclude alerts where the process parent is a known administrative tool (e.g., mstsc.exe, vncviewer.exe, or a specific corporate RDP client) and the destination IP is within the internal 10.0.0.0/8 or 192.168.0.0/16 ranges, provided the connection duration is less than 15 minutes.

• Scenario: An IT support technician installs a new version of a remote management agent (e.g., ConnectWise, TeamViewer, or a custom in-house tool) that inadvertently uses a shared library or binary with the same SHA256 hash as the Remcos IOC due to a common vendor dependency or build artifact. The process runs as a service under the SYSTEM account.

  • Filter/Exclusion: Exclude alerts where the process is running as a Windows Service (check Win32_Service or sc.exe query) and the executable path is located in C:\Program Files\ or C:\Program Files (x86)\ rather than user-specific directories like %AppData% or %LocalAppData%.

• Scenario: A security team performs a red team exercise or a vulnerability assessment where they deploy a benign “canary” token or a specific monitoring agent that mimics Remcos behavior to test detection coverage. The process is intentionally launched from a non-standard location like C:\Temp\ or `C:\Users<user