This hunt targets known indicators of compromise associated with the Remcos remote access trojan, which adversaries deploy to establish persistent control and exfiltrate sensitive data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected hosts before the malware can be leveraged for lateral movement or data exfiltration.
Malware Family: Remcos Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 172[.]111[.]163[.]166:65070 | botnet_cc | 2026-09-04 | 100% |
| ip:port | 213[.]152[.]162[.]118:49006 | botnet_cc | 2026-09-04 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["213.152.162.118", "172.111.163.166"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["213.152.162.118", "172.111.163.166"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Remote Desktop Administration via RDP Wrapper or Third-Party Tools: Legitimate IT administrators often use tools like rdpwrap or proprietary remote access solutions (e.g., AnyDesk, TeamViewer) to manage Windows servers. If these tools inject code into the explorer.exe or winlogon.exe process to maintain persistent RDP sessions, they may match the process injection or memory allocation IOCs associated with Remcos.
services.exe or svchost.exe and the command line contains specific arguments for known admin tools (e.g., --remote, --admin). Alternatively, whitelist known executable paths like C:\Program Files\AnyDesk\AnyDesk.exe or C:\rdpwrap\rdpwrap.exe.Software Deployment via SCCM or Intune: Enterprise software distribution platforms like System Center Configuration Manager (SCCM) or Microsoft Intune frequently execute installers or configuration scripts that modify system files or inject code into running processes to apply patches or deploy agents. This can trigger IOCs related to file modification or process injection if the deployment agent runs with high privileges and modifies protected binaries.
CcmExec.exe (SCCM) or IntuneAgent.exe, or where the command line includes standard deployment flags such as /install, /update, or --silent.Antivirus/EDR Real-Time Protection Scanning: Security products like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne often perform real-time memory scanning and file integrity checks. These processes may temporarily map or modify sections of executable files in memory to analyze them, which can mimic the memory injection or file modification IOCs used by Remcos for stealth.