This hunt targets the presence of known Remcos Remote Access Trojan indicators, which adversaries deploy to establish persistent backdoors for remote control and data exfiltration. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, mitigating the risk of lateral movement and undetected command-and-control sessions before they escalate into a full breach.
Malware Family: Remcos Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 102[.]220[.]161[.]72:2404 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 209[.]54[.]102[.]160:2404 | botnet_cc | 2026-09-08 | 100% |
| ip:port | 217[.]60[.]103[.]46:2511 | botnet_cc | 2026-09-08 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["102.220.161.72", "217.60.103.46", "209.54.102.160"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.161.72", "217.60.103.46", "209.54.102.160"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
msiexec.exe or setup.exe where the parent process is explorer.exe or cmd.exe initiated by an admin account, and restrict the file path to standard software installation directories (e.g., C:\Program Files\Remcos\).ccmexec.exe, lansweeper.exe, or intunescan.exe) and the action is a read-only operation on registry keys or file properties.VeeamBackup.exe, AcronisService.exe) or where the destination path contains standard backup directory names (e.g., \Backup\, \Veeam\, \Acronis\).