ThreatFox: Remcos IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies the presence of four specific Indicators of Compromise (IOCs) linked to the Remcos remote access trojan, which adversaries deploy to establish persistent command-and-control channels and exfiltrate sensitive data. A SOC team should proactively hunt for these IOCs within Azure Sentinel because early identification of Remcos activity allows for rapid containment before attackers can leverage its advanced capabilities to map the network and escalate privileges.

IOC Summary

Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`199[.]85[.]8[.]183:2404`	botnet_cc	2026-08-30	75%
ip:port	`103[.]153[.]183[.]25:3231`	botnet_cc	2026-08-30	100%
ip:port	`69[.]167[.]11[.]148:2404`	botnet_cc	2026-08-30	100%
ip:port	`45[.]74[.]7[.]158:4332`	botnet_cc	2026-08-30	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["199.85.8.183", "69.167.11.148", "103.153.183.25", "45.74.7.158"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["199.85.8.183", "69.167.11.148", "103.153.183.25", "45.74.7.158"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, along with targeted mitigation strategies:

Scenario: Endpoint Protection Policy Deployment via Microsoft Intune/SCCM
- Context: During a scheduled maintenance window, the security team deploys new Antimalware policies or updates to endpoints. The deployment process often involves downloading configuration scripts or agents that match Remcos network signatures (specifically HTTP POST requests to known update domains) and file hash patterns used by the detection logic.
- Filter/Exclusion: Create an exclusion rule based on the Source User being a specific service account (e.g., DOMAIN\SCCM-SVC) or the Process Name matching known deployment tools like ccmsetup.exe, intune-management-agent.exe, or msiexec.exe.
Scenario: Scheduled Backup Jobs Utilizing Remcos-Compatible Protocols
- Context: Enterprise backup solutions (such as Veeam, Commvault, or Acronis) often run nightly jobs that initiate network connections to central management servers. These agents may generate traffic patterns and file creation events (e.g., temporary log files in C:\ProgramData\BackupAgent) that mimic the IOCs associated with Remcos command-and-control communication.
- Filter/Exclusion: Exclude alerts where the Process Path contains known backup vendor directories (e.g., \Veeam\, \Commvault\, \Acronis\) and the execution time falls within the defined maintenance window (e.g., 02:00–04:00 local time).
Scenario: Internal IT Asset Management Scanning
- Context: Automated asset discovery tools like Lansweeper, PDQ Inventory, or SolarWinds periodically scan endpoints to collect hardware and software inventory. These scanners often