This hunt targets the presence of known IOCs associated with the Remcos remote access trojan, which adversaries deploy to establish persistent, stealthy control over compromised endpoints. Proactively hunting for these indicators in Azure Sentinel is critical because Remcos is frequently used in targeted attacks to exfiltrate data and execute lateral movement, allowing the SOC to identify and isolate infected assets before the threat actor achieves their operational objectives.
Malware Family: Remcos Total IOCs: 10 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 193[.]26[.]115[.]223:4411 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 217[.]60[.]195[.]34:18631 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 184[.]107[.]115[.]238:2404 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 107[.]161[.]168[.]253:7789 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 172[.]111[.]131[.]3:56090 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 213[.]152[.]162[.]108:49006 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 204[.]44[.]69[.]221:2626 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 155[.]103[.]69[.]38:14647 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 217[.]60[.]195[.]210:2404 | botnet_cc | 2026-09-03 | 100% |
| ip:port | 217[.]60[.]195[.]33:17545 | botnet_cc | 2026-09-03 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["184.107.115.238", "107.161.168.253", "204.44.69.221", "217.60.195.210", "155.103.69.38", "172.111.131.3", "217.60.195.33", "217.60.195.34", "213.152.162.108", "193.26.115.223"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["184.107.115.238", "107.161.168.253", "204.44.69.221", "217.60.195.210", "155.103.69.38", "172.111.131.3", "217.60.195.33", "217.60.195.34", "213.152.162.108", "193.26.115.223"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom internal build agent or CI/CD runner that uses a shared binary name or hash (e.g., agent.exe or a specific SHA-256) matching one of the Remcos IOCs to facilitate automated deployment tasks on Windows servers.
jenkins.exe, azureagent.exe, gitlab-runner.exe) or where the image path resides in a designated build directory (e.g., C:\BuildAgents\).Scenario: An IT administrator installs a third-party remote support tool (such as TeamViewer, AnyDesk, or LogMeIn) that shares a similar module name or memory footprint characteristic with Remcos, particularly if the tool is installed in a non-standard directory like C:\Users\Admin\AppData\Local\ rather than C:\Program Files\.
TeamViewer, AnyDesk, LogMeIn) or where the process is signed by a trusted remote support vendor certificate.Scenario: A legacy application or internal utility uses a dynamic-link library (DLL) with a name matching a Remcos IOC (e.g., remcos.dll or a similar generic name) for inter-process communication or plugin loading, which is loaded by a trusted application like explorer.exe or a specific business line application.
Microsoft Corporation, Internal Corp Name) or where the DLL path is within the application’s installation directory (e.g., C:\Program Files\InternalApp\).Scenario: A security