ThreatFox: Remcos IOCs

Hunt Hypothesis

This detection rule identifies potential Remcos remote administration tool infections by monitoring for specific indicators of compromise such as unique file hashes and network connections. Proactive hunting in Azure Sentinel is critical to uncover stealthy post-compromise activities that may evade standard signature-based defenses, ensuring early containment of this sophisticated remote access malware.

IOC Summary

Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["208.64.33.69", "178.16.52.53", "213.152.162.116"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["208.64.33.69", "178.16.52.53", "213.152.162.116"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["goldenbeigesurfers.live"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Backup Jobs Executing via PowerShell

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize scheduled tasks that invoke powershell.exe to query system status or manage agents. These scripts may generate network connections to known update servers or internal repositories that match the Remcos C2 beacon pattern (specifically HTTP/HTTPS POST requests with specific User-Agent strings).
  • Filter/Exclusion: Add a process exclusion for the backup service executable (e.g., C:\Program Files\Veeam\Backup and Replication\BackupService.exe) or filter alerts where the parent process is Vssvc.exe (Volume Shadow Copy Service) during standard maintenance windows.

• Scenario: Endpoint Protection Agent Heartbeats

  • Context: Security agents like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Carbon Black frequently communicate with their management consoles using specific IOCs that overlap with Remcos signatures. The agent’s heartbeat mechanism often involves periodic DNS queries and HTTP POSTs to the cloud console which can mimic the Remcos command-and-control traffic profile.
  • Filter/Exclusion: Exclude alerts where the source process is a known EDR agent (e.g., C:\Program Files\McAfee\Agent\x86\mfeagent.exe or C:\Windows\System32\DPS\dpssvc.exe) and the destination IP belongs to the vendor’s trusted cloud range.

• Scenario: Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune deployment tasks often push software updates or configuration scripts that trigger network traffic matching Remcos IOCs