ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Remcos remote access trojan by monitoring for specific indicators of compromise such as known file hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical to identify early-stage infections that could enable persistent lateral movement and data exfiltration before the malware establishes deep footholds within the environment.

IOC Summary

Malware Family: Remcos Total IOCs: 10 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["217.60.102.8", "151.243.109.130", "195.177.94.61", "38.240.40.231", "46.151.182.93", "89.106.83.41", "46.151.182.148"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.102.8", "151.243.109.130", "195.177.94.61", "38.240.40.231", "46.151.182.93", "89.106.83.41", "46.151.182.148"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["onboarding.radiantfluxstudio.com", "digitalhoster.4nmn.com", "bokiass.noip.at"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: Enterprise Configuration Management (SCCM) or Microsoft Intune agents frequently download and execute patching scripts that may match Remcos IOCs (specifically file hashes or network connections to update servers). These legitimate updates often trigger the detection when the agent communicates with central management points.
  • Filter/Exclusion: Exclude alerts where the Process Name is ccmsetup.exe, wsman.exe, or msiexec.exe AND the Parent Process Name matches known enterprise deployment tools (e.g., TaskSchedulerService). Additionally, filter out network connections to internal IP ranges designated for patch management servers.

• Scenario: Scheduled Backup Jobs Utilizing Remcos-Compatible Agents

  • Context: Third-party backup solutions (such as Veeam, Commvault, or Acronis) often run scheduled jobs that establish persistent connections and generate file artifacts similar to the Remcos IOCs. If the backup agent’s installation directory contains a hash matching one of the 10 Remcos indicators, it will trigger a false positive during nightly windows.
  • Filter/Exclusion: Create an exclusion rule for processes running under the SYSTEM or specific service accounts (e.g., NT SERVICE\VeeamBackup) where the File Path resides within known backup installation directories (e.g., C:\Program Files\Commvault\...).

• Scenario: Endpoint Detection and Response (EDR) Self-Scans

  • Context: The organization’s primary EDR solution (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) may perform self-scans or update