ThreatFox: Remcos IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Remcos remote administration tool by monitoring seven specific indicators of compromise known to facilitate command and control communications. Proactively hunting for these signatures in Azure Sentinel is critical because Remcos is frequently deployed as a post-exploitation tool, allowing attackers to maintain persistent access and exfiltrate sensitive data before traditional alerts trigger.

IOC Summary

Malware Family: Remcos Total IOCs: 7 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["103.83.87.87", "155.103.69.20"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.83.87.87", "155.103.69.20"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["whichkindwahalabethisonesooluwahelurboi.duckdns.org", "eventras.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

False Positive Scenarios for “ThreatFox: Remcos IOCs” Rule

• Scenario: Legitimate Remote Management via TeamViewer or AnyDesk

  • Context: Enterprise IT Helpdesk teams frequently use remote access tools like TeamViewer, AnyDesk, or Splashtop to troubleshoot user workstations. These applications often utilize similar communication ports and process behaviors (e.g., teamviewer.exe establishing outbound connections) that overlap with Remcos RAT signatures, particularly regarding network beaconing and file system monitoring.
  • Suggested Filter/Exclusion: Create a whitelist exclusion for the specific executable paths of these tools (e.g., C:\Program Files\TeamViewer\TeamViewer.exe) and exclude their known SHA-256 hashes from the detection logic. Additionally, filter out alerts where the parent process is a known service account (DOMAIN\HelpDeskAdmin).

• Scenario: Scheduled Antivirus or EDR Scans

  • Context: Automated security scans performed by tools like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Symantec Endpoint Protection often trigger file integrity checks and process monitoring events. When these agents scan the system registry or monitor network traffic during off-hours (e.g., nightly jobs), their activity can mimic the “file creation” and “network connection” IOCs associated with Remcos.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 01:00 and 05:00 UTC if the source process matches known EDR agents (e.g., MsMpEng.exe, FalconService.exe). Alternatively, add a rule to suppress alerts where the “User Context” is the local system account (NT AUTHORITY\SYSTEM) rather than an interactive user.

• Scenario: Deployment of Internal Monitoring Agents