ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of RemcoS remote access trojans by detecting specific indicators of compromise within network and endpoint telemetry. Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage lateral movement and data exfiltration attempts before they escalate into full-scale breaches.

IOC Summary

Malware Family: Remcos Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["103.186.64.138", "204.44.93.75"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.186.64.138", "204.44.93.75"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Agent Updates and Scans

  • Scenario: The deployment of a new definition update or a scheduled full system scan by endpoint protection tools (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) often generates network traffic to vendor cloud endpoints. If the Remcos IOCs include generic IP ranges or domain names that overlap with these vendors’ update servers, legitimate background traffic will trigger the rule.
  • Filter/Exclusion: Create an exclusion list based on known process paths for security agents (e.g., C:\Program Files\CrowdStrike\fs.exe or MsMpEng.exe) and whitelist specific destination IP ranges associated with the vendor’s update infrastructure if they match the Remcos IOCs.

• IT Administration Remote Management Sessions

  • Scenario: System administrators frequently use remote management tools to troubleshoot workstations or deploy configurations. Tools like Microsoft SCCM (Configuration Manager), Ivanti, or TeamViewer may establish connections to internal gateways or external support portals that share IP addresses or domain hashes with the Remcos IOCs, particularly during scheduled maintenance windows.
  • Filter/Exclusion: Filter out traffic originating from specific administrative user accounts (e.g., DOMAIN\IT_Admins) or restrict the rule alerting logic to exclude connections initiated by known management service executables (e.g., ccmexec.exe, tv_agent.exe).

• Scheduled Software Deployment and Patch Management

  • Scenario: Automated patch management systems often download large payloads from external repositories. If the organization uses a third-party deployment tool like Ansible, Chocolatey, or JFrog Artifactory that pulls packages from a