This hypothesis posits that adversaries are actively deploying the Remcos remote access trojan to establish persistent command-and-control channels within our Azure Sentinel environment. Proactive hunting is critical because early detection of these specific IOCs allows the SOC team to identify compromised endpoints before the malware exfiltrates sensitive data or pivots laterally across the network.
Malware Family: Remcos Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 5[.]8[.]19[.]155:14646 | botnet_cc | 2026-06-29 | 75% |
| ip:port | 45[.]74[.]7[.]168:2428 | botnet_cc | 2026-06-29 | 75% |
| ip:port | 27[.]102[.]137[.]139:14645 | botnet_cc | 2026-06-29 | 75% |
| ip:port | 203[.]159[.]90[.]247:2404 | botnet_cc | 2026-06-29 | 75% |
| ip:port | 107[.]172[.]13[.]198:8080 | botnet_cc | 2026-06-29 | 75% |
| ip:port | 130[.]12[.]182[.]90:2404 | botnet_cc | 2026-06-29 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["130.12.182.90", "107.172.13.198", "27.102.137.139", "45.74.7.168", "203.159.90.247", "5.8.19.155"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["130.12.182.90", "107.172.13.198", "27.102.137.139", "45.74.7.168", "203.159.90.247", "5.8.19.155"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Endpoint Security Scanning by CrowdStrike Falcon
CrowdStrike.exe or csfalcon) generates network connections to internal update servers that match the IP addresses of known Remcos C2 infrastructure (often hosted on AWS/Azure ranges).C:\Program Files\CrowdStrike\csfalcon.exe and the destination port matches standard update ports (e.g., 443, 80) within the internal security group.Microsoft System Center Configuration Manager (SCCM) Deployment
ccmexec.exe) establishes connections to the Distribution Point server, which may be hosted on an IP range that overlaps with Remcos IOCs or utilizes similar TLS certificate fingerprints for internal communication.ccmexec.exe originating from the “Management” OU (Organizational Unit) when connecting to known internal Distribution Point subnets, regardless of the destination IP matching the Remcos IOC list.Scheduled PowerShell Health Checks by IT Operations
Task Scheduler) runs a custom PowerShell script (HealthCheck.ps1) every morning at 08:00 to verify connectivity with external vendor APIs. This script uses Invoke-WebRequest to ping specific endpoints that happen to share the same ASN (Autonomous System Number) or IP blocks as the