ThreatFox: Remcos IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying the Remcos remote access trojan to establish persistent command-and-control channels within our Azure environment. Proactive hunting is critical because early detection of these specific IOCs allows the SOC team to isolate compromised endpoints before the malware can exfiltrate sensitive data or pivot laterally across the network.

IOC Summary

Malware Family: Remcos Total IOCs: 4 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["102.220.160.103", "172.111.163.169", "79.141.165.55"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.160.103", "172.111.163.169", "79.141.165.55"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["fb88.style"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule within an enterprise environment, including suggested filters or exclusions:

• Endpoint Detection and Response (EDR) Agent Updates

  • Scenario: The EDR agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a scheduled background update. During this process, the agent downloads and executes a new definition package that includes a legitimate hash matching one of the Remcos IOCs (often due to shared code libraries or similar cryptographic signatures in the vendor’s supply chain).
  • Filter/Exclusion: Create an exclusion for the specific EDR service executable path (e.g., C:\Program Files\CrowdStrike\fs.exe or C:\Windows\System32\MsMpEng.exe) and whitelist the associated process tree. Additionally, exclude events where the parent process is the OS Update Service (TrustedInstaller.exe).

• Software Deployment via Configuration Management Tools

  • Scenario: An IT administrator uses a configuration management tool (e.g., Microsoft SCCM/MECM, Ansible, or Puppet) to deploy a new application package across 500 workstations. The deployment script invokes a PowerShell job that downloads and runs an installer containing a shared DLL with a hash identical to the Remcos remcos.exe IOC.
  • Filter/Exclusion: Filter for events where the parent process is the deployment agent (e.g., ccmexec.exe, Ansible-Runner.exe) or the PowerShell host (powershell.exe). Add an exclusion rule based on the specific “Deployment ID” or “Package Name” associated with known internal software updates.

• Scheduled Antivirus Definition Scans

  • Scenario: A third-party antivirus solution (e.g., Symantec Endpoint Protection, McAfee