This hypothesis posits that adversaries are actively deploying the Remcos remote access trojan to establish persistent command-and-control channels within our Azure environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical to detect early-stage lateral movement and data exfiltration before the malware can fully compromise sensitive workloads.
Malware Family: Remcos Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 27[.]102[.]137[.]139:465 | botnet_cc | 2026-07-12 | 75% |
| ip:port | 216[.]9[.]225[.]38:14642 | botnet_cc | 2026-07-12 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["27.102.137.139", "216.9.225.38"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["27.102.137.139", "216.9.225.38"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:
Endpoint Protection Scanning of Quarantine Folders
Quarantine or ThreatHistory directories where previous malware samples are stored. If a legacy Remcos sample was previously detected and quarantined by the EDR, the agent’s scheduled deep-scan job may re-process these files, triggering the IOCs (specifically file hashes or network beacons) without an active infection present.NT SERVICE\WdNisSvc or CrowdStrike Falcon Sensor) and filter out file paths containing \Quarantine, \ThreatHistory, or \ProtectedFiles.IT Administration: Legacy Software Deployment via SCCM/Intune
Setup.exe), it may generate network traffic to known update servers or create temporary files matching the Remcos IOCs before the actual application logic runs.ccmexec.exe) and Intune Management Extension (Microsoft.IntuneManagementExtension.exe). Additionally, exclude network connections where the destination IP belongs to the internal software distribution point subnet (e.g., 10.x.x.x or 172.16.x.x).