The detection identifies potential Remcos malware activity through known IOCs, indicating an adversary may be establishing persistence and exfiltrating data. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats before significant data loss occurs.
IOC Summary
Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 5[.]101[.]81[.]163:47524 | botnet_cc | 2026-05-19 | 75% |
| ip:port | 144[.]172[.]94[.]91:1122 | botnet_cc | 2026-05-19 | 75% |
| ip:port | 144[.]172[.]94[.]91:2255 | botnet_cc | 2026-05-19 | 75% |
| ip:port | 144[.]172[.]94[.]91:3333 | botnet_cc | 2026-05-19 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["144.172.94.91", "5.101.81.163"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["144.172.94.91", "5.101.81.163"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Scheduled System Maintenance Task
Description: A legitimate scheduled task runs a script that matches the Remcos IOC due to similar file names or paths.
Filter/Exclusion: process.name != "schtasks.exe" or file.name != "remcos.exe"
Scenario: Admin Tool for Remote Management
Description: An admin uses a remote management tool like PsExec or PSTools to execute a script that matches the Remcos IOC.
Filter/Exclusion: process.name != "psexec.exe" or process.name != "psexec.exe"
Scenario: Legitimate Software Update Process
Description: A software update process from a trusted vendor (e.g., Microsoft Update, Adobe Updater) downloads a file that matches a Remcos IOC due to similar naming.
Filter/Exclusion: file.name != "update.exe" or file.hash != "known-good-hash"
Scenario: PowerShell Script for System Monitoring
Description: A PowerShell script used for system monitoring or log analysis (e.g., PowerShell ISE, PowerShell Core) executes a command that matches the Remcos IOC.
Filter/Exclusion: process.name != "powershell.exe" or process.parent.name != "explorer.exe"
Scenario: Backup Job Using Third-Party Tool
Description: A backup job using a third-party tool like Veeam, Acronis, or Dell Backup and Recovery runs a process that matches the Remcos IOC.
Filter/Exclusion: process.name != "veeam.exe" or process.name != "acronis.exe"