ThreatFox: Remcos IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of the Remcos Remote Access Trojan by detecting five specific Indicators of Compromise (IOCs) known to facilitate persistent command and control communications. Proactively hunting for these signatures in Azure Sentinel is critical because early identification of Remcos activity allows the SOC team to isolate compromised endpoints before attackers can exfiltrate sensitive data or establish long-term footholds within the organization’s cloud infrastructure.

IOC Summary

Malware Family: Remcos Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`37[.]27[.]30[.]5:2406`	botnet_cc	2026-07-13	75%
ip:port	`37[.]27[.]30[.]5:2404`	botnet_cc	2026-07-13	75%
ip:port	`37[.]27[.]30[.]5:2405`	botnet_cc	2026-07-13	75%
ip:port	`216[.]9[.]225[.]38:14645`	botnet_cc	2026-07-13	75%
ip:port	`211[.]159[.]223[.]14:22005`	botnet_cc	2026-07-13	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["37.27.30.5", "216.9.225.38", "211.159.223.14"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["37.27.30.5", "216.9.225.38", "211.159.223.14"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Remcos

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Scanning and Quarantine Operations
- Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) performs deep heuristic scans on the C:\Program Files\Remcos directory. During this process, the scanner may spawn temporary processes that match Remcos IOCs or generate network connections to update definition servers that share IP ranges with known Remcos C2 infrastructure.
- Filter/Exclusion: Exclude traffic and process execution originating from the specific EDR service accounts (e.g., LocalSystem, NT AUTHORITY\SYSTEM) where the parent process is the EDR agent executable (e.g., csagent.exe, SentinelOne.exe). Additionally, whitelist internal IP ranges used by the security vendor’s update servers.
Software Deployment and Patch Management Jobs
- Scenario: Automated patch management tools like SCCM (Microsoft Endpoint Configuration Manager) or Ivanti deploy updates to a legacy application suite named “Remcos” (a generic name often used for internal inventory or remote access tools). The deployment agent (ccmexec.exe or IvAgent.exe) creates scheduled tasks that launch the Remcos client, triggering file integrity checks and network handshakes against the vendor’s update endpoints.
- Filter/Exclusion: Create a rule to suppress alerts where the parent process is identified as a known deployment agent (ccmexec.exe, IvAgent.exe, or WSUSClient) and the execution path matches the standard corporate software installation directory (e.g., C:\Program Files\Microsoft Configuration Manager).
IT Helpdesk Remote Support Sessions
- Scenario: IT