ThreatFox: Remcos IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving four specific Indicators of Compromise (IOCs) linked to the Remcos remote administration tool, which is frequently leveraged by threat actors for command and control operations. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly detect early-stage infections and mitigate potential data exfiltration or lateral movement before the adversary establishes a persistent foothold within the network.

IOC Summary

Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`89[.]106[.]1[.]118:47756`	botnet_cc	2026-08-28	75%
ip:port	`141[.]98[.]10[.]129:2404`	botnet_cc	2026-08-28	75%
ip:port	`96[.]9[.]226[.]22:9462`	botnet_cc	2026-08-28	75%
ip:port	`107[.]175[.]88[.]99:2404`	botnet_cc	2026-08-28	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["141.98.10.129", "96.9.226.22", "107.175.88.99", "89.106.1.118"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["141.98.10.129", "96.9.226.22", "107.175.88.99", "89.106.1.118"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Internal Patch Management Deployment
- Context: The organization uses Microsoft System Center Configuration Manager (SCCM) or WSUS to deploy a new security update. The deployment process involves downloading Remcos-related components or scripts from an internal repository, triggering the IOCs associated with the tool’s signature hash and network behavior.
- Filter/Exclusion: Create an exclusion based on the source IP range of the SCCM site server (e.g., 10.20.50.10) and filter out events where the process name matches ccmsetup.exe or wuauserv.exe.
Scenario: Scheduled Endpoint Security Scans
- Context: The enterprise runs a nightly scheduled job using CrowdStrike Falcon or Carbon Black to perform deep memory scans. During these scans, the EDR agent may spawn temporary processes that mimic the file system interactions and registry keys defined in the Remcos IOCs, specifically when checking for legacy RMM tools.
- Filter/Exclusion: Exclude alerts where the parent process is FalconSensorService.exe (CrowdStrike) or cbengine.exe (Carbon Black) occurring between 02:00 and 04:00 AM local time, aligning with the maintenance window.
Scenario: Legacy Remote Management Tool Usage
- Context: The IT Helpdesk utilizes a legacy RMM solution like Lansweeper or NinjaOne which includes Remcos as an optional agent for remote control sessions. When technicians initiate a “Remote Control” session from the management console to a workstation, the IOCs are triggered by the