ThreatFox: Remcos IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Remcos remote access trojans by detecting six specific indicators of compromise across network and endpoint telemetry. Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage lateral movement and data exfiltration activities before they escalate into full-scale breaches.

IOC Summary

Malware Family: Remcos Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`198[.]135[.]54[.]39:14642`	botnet_cc	2026-06-30	75%
ip:port	`155[.]103[.]71[.]115:14656`	botnet_cc	2026-06-30	75%
ip:port	`103[.]11[.]41[.]10:2120`	botnet_cc	2026-06-30	75%
ip:port	`185[.]115[.]164[.]60:9486`	botnet_cc	2026-06-29	75%
ip:port	`103[.]11[.]41[.]10:52046`	botnet_cc	2026-06-29	75%
ip:port	`191[.]101[.]51[.]10:2404`	botnet_cc	2026-06-29	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["185.115.164.60", "191.101.51.10", "198.135.54.39", "103.11.41.10", "155.103.71.115"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.115.164.60", "191.101.51.10", "198.135.54.39", "103.11.41.10", "155.103.71.115"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Remcos

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, tailored for an enterprise environment:

Endpoint Security Agent Self-Updates and Scans
- Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently execute background processes that match Remcos IOCs. Specifically, the remcos service name or associated hashing algorithms used by these agents during their daily signature definition updates or scheduled system integrity scans can trigger the rule.
- Filter/Exclusion: Create an exclusion based on the Process Name (e.g., falconcontainer.exe, s1agent.exe) and the Parent Process (the main EDR service). Additionally, filter out events originating from known Trusted Paths such as C:\Program Files\CrowdStrike\ or C:\Windows\SysWOW64\Microsoft Defender Antivirus.
IT Asset Management and Inventory Scans
- Scenario: Automated inventory tools like Microsoft SCCM (Configuration Manager), Ivanti, or Lansweeper deploy agents that enumerate system components, registry keys, and network configurations. These agents often spawn temporary processes with names or behaviors mimicking the Remcos communication modules to gather hardware fingerprints, leading to false detections during scheduled inventory cycles (e.g., every Monday at 02:00 AM).
- Filter/Exclusion: Exclude traffic initiated by specific Service Accounts used for asset management (e.g., svc_sccm_agent, svc_ivanti). Implement a time-based filter to suppress alerts during known maintenance windows where these inventory scans are scheduled.
Remote Desktop and Management Session Launchers
- Scenario: In environments utilizing **Microsoft Remote Desktop Services