ThreatFox: Remcos IOCs

Hunt Hypothesis

This hunt targets adversary behavior consistent with the Remcos remote access trojan by scanning Azure Sentinel logs against a curated set of 15 indicators of compromise to identify potential command-and-control communications or lateral movement artifacts. Proactive hunting for these specific IOCs is critical within the Azure environment to detect early-stage infections before they escalate into full-scale data exfiltration incidents, ensuring rapid containment of this high-severity threat.

IOC Summary

Malware Family: Remcos Total IOCs: 15 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	45[.]74[.]7[.]173:9521	botnet_cc	2026-06-28	75%
ip:port	141[.]98[.]10[.]150:14648	botnet_cc	2026-06-28	75%
ip:port	103[.]83[.]87[.]87:25900	botnet_cc	2026-06-28	75%
ip:port	103[.]11[.]41[.]20:201	botnet_cc	2026-06-28	75%
ip:port	5[.]8[.]19[.]157:14644	botnet_cc	2026-06-27	75%
ip:port	5[.]206[.]224[.]226:2404	botnet_cc	2026-06-27	75%
ip:port	45[.]74[.]7[.]170:3305	botnet_cc	2026-06-27	75%
ip:port	45[.]74[.]7[.]165:8455	botnet_cc	2026-06-27	75%
ip:port	45[.]74[.]7[.]169:7312	botnet_cc	2026-06-27	75%
ip:port	173[.]231[.]188[.]244:14646	botnet_cc	2026-06-27	75%
ip:port	104[.]37[.]173[.]203:14643	botnet_cc	2026-06-27	75%
ip:port	103[.]11[.]41[.]20:2753	botnet_cc	2026-06-27	75%
ip:port	103[.]11[.]41[.]10:49584	botnet_cc	2026-06-27	75%
ip:port	103[.]11[.]41[.]20:9087	botnet_cc	2026-06-27	75%
ip:port	144[.]31[.]236[.]240:27018	botnet_cc	2026-06-27	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["103.11.41.10", "103.11.41.20", "104.37.173.203", "45.74.7.173", "103.83.87.87", "45.74.7.169", "141.98.10.150", "45.74.7.165", "144.31.236.240", "45.74.7.170", "5.8.19.157", "173.231.188.244", "5.206.224.226"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.11.41.10", "103.11.41.20", "104.37.173.203", "45.74.7.173", "103.83.87.87", "45.74.7.169", "141.98.10.150", "45.74.7.165", "144.31.236.240", "45.74.7.170", "5.8.19.157", "173.231.188.244", "5.206.224.226"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled

References

• ThreatFox — Remcos

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Agent Updates via Scheduled Tasks

  • Scenario: The organization uses a centralized endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) that performs daily signature and engine updates. These updates often involve downloading and executing installer packages from trusted vendor repositories that may share IP addresses or file hashes with the Remcos IOCs, particularly if the threat intelligence feed is broad.
  • Filter/Exclusion: Create a rule exclusion for processes originating from the specific Endpoint Protection service accounts (e.g., SYSTEM, LocalService) and restrict alerts to files located in known vendor update directories (e.g., C:\Program Files\Microsoft Defender\Updates or C:\ProgramData\CrowdStrike).

• IT Asset Management Scans by Admin Tools

  • Scenario: IT administrators utilize asset discovery tools like LanDesk, PDQ Deploy, or SolarWinds NPM to scan workstations for software inventory. These tools frequently push small executable agents or scripts that connect to internal management servers, which might trigger the Remcos network connection IOCs if those servers share infrastructure with known threat actors.
  • Filter/Exclusion: Exclude traffic and process execution originating from specific administrative service accounts (e.g., DOMAIN\svc_asset_mgmt) and whitelist the specific executable paths of the asset management agents (e.g., C:\Program Files\PDQ Deploy\Agent.exe).

• Third-Party Remote Support Sessions

  • Scenario: Help desk teams utilize remote support software such as TeamViewer, AnyDesk, or LogMeIn to troubleshoot user issues. These applications establish persistent connections and spawn helper processes that communicate with external relay