This hunt targets adversary behavior consistent with the Remcos Remote Access Trojan (RAT), specifically looking for network connections or file artifacts matching its known Indicators of Compromise to identify active command-and-control communications. Proactively hunting for these signatures in Azure Sentinel is critical because early detection of this sophisticated RAT can prevent data exfiltration and lateral movement before the adversary establishes a persistent foothold within the environment.
Malware Family: Remcos Total IOCs: 13 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 46[.]151[.]182[.]38:8080 | botnet_cc | 2026-07-14 | 75% |
| domain | connectus.cristianoobrigado.shop | botnet_cc | 2026-07-14 | 75% |
| ip:port | 173[.]231[.]188[.]245:21075 | botnet_cc | 2026-07-14 | 75% |
| ip:port | 216[.]9[.]225[.]38:14649 | botnet_cc | 2026-07-14 | 75% |
| ip:port | 204[.]44[.]69[.]214:14647 | botnet_cc | 2026-07-14 | 75% |
| ip:port | 192[.]255[.]195[.]147:14647 | botnet_cc | 2026-07-14 | 75% |
| ip:port | 185[.]115[.]164[.]60:65531 | botnet_cc | 2026-07-14 | 75% |
| ip:port | 185[.]115[.]164[.]60:11883 | botnet_cc | 2026-07-14 | 75% |
| ip:port | 172[.]111[.]169[.]69:56090 | botnet_cc | 2026-07-14 | 75% |
| ip:port | 46[.]183[.]222[.]96:465 | botnet_cc | 2026-07-14 | 75% |
| ip:port | 204[.]44[.]69[.]214:14644 | botnet_cc | 2026-07-14 | 75% |
| domain | judasbuoyeahuruhusitemnaakezigbonduyaaaa.duckdns.org | botnet_cc | 2026-07-14 | 75% |
| ip:port | 213[.]152[.]162[.]21:11525 | botnet_cc | 2026-07-14 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["173.231.188.245", "204.44.69.214", "185.115.164.60", "216.9.225.38", "46.183.222.96", "192.255.195.147", "213.152.162.21", "46.151.182.38", "172.111.169.69"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["173.231.188.245", "204.44.69.214", "185.115.164.60", "216.9.225.38", "46.183.222.96", "192.255.195.147", "213.152.162.21", "46.151.182.38", "172.111.169.69"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["connectus.cristianoobrigado.shop", "judasbuoyeahuruhusitemnaakezigbonduyaaaa.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule, tailored for an enterprise environment:
Software Deployment via SCCM/Intune: Enterprise IT teams frequently deploy standard endpoint protection or remote management agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) that utilize shared code libraries. If the deployment package includes a specific DLL or executable hash matching one of the 13 Remcos IOCs (often common in open-source components like libcurl or specific Java runtime versions), the rule may trigger during mass rollouts.
WSUS, SCCM Management Point) and restrict alerts to processes launched under the context of deployment automation tools (e.g., ccmexec.exe, MicrosoftEdgeUpdate.exe).Scheduled Maintenance Scripts for Remote Support Tools: Administrators often run scheduled PowerShell or Batch scripts to update remote support utilities like TeamViewer, AnyDesk, or LogMeIn. These tools frequently share network signatures or file hashes with Remcos due to similar telemetry protocols (e.g., specific HTTP User-Agent strings or certificate thumbprints used for secure channel establishment).
svchost.exe running taskscheduler) specifically during maintenance windows (e.g., 02:00–04:00 local time) and filter out network connections destined to known vendor IP ranges associated with these support tools.Development Environment Build Pipelines: In DevOps environments, CI/CD pipelines (using Jenkins, GitLab Runner, or Azure DevOps) often pull dependencies from public repositories that may contain legacy libraries flagged by the Remcos IOC set. A build agent compiling a new application might generate network traffic or file creation events matching the “Remcos” signature for legitimate third-party SDK