This detection rule identifies adversary activity consistent with the Remcos remote access trojan by monitoring for specific indicators of compromise across endpoints and network traffic. Proactive hunting in Azure Sentinel is critical to rapidly uncover persistent lateral movement or data exfiltration attempts before they escalate into a full-scale breach, given Remcos’s capability to evade standard signature-based defenses.
Malware Family: Remcos Total IOCs: 8 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 66[.]163[.]114[.]54:1664 | botnet_cc | 2026-07-01 | 75% |
| ip:port | 27[.]102[.]118[.]100:7253 | botnet_cc | 2026-07-01 | 75% |
| ip:port | 209[.]54[.]103[.]155:14645 | botnet_cc | 2026-07-01 | 75% |
| ip:port | 209[.]54[.]103[.]155:14647 | botnet_cc | 2026-07-01 | 75% |
| ip:port | 209[.]54[.]103[.]155:14641 | botnet_cc | 2026-07-01 | 75% |
| ip:port | 185[.]115[.]164[.]60:63283 | botnet_cc | 2026-07-01 | 75% |
| ip:port | 103[.]11[.]41[.]20:61073 | botnet_cc | 2026-07-01 | 75% |
| ip:port | 103[.]11[.]41[.]10:5007 | botnet_cc | 2026-07-01 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["103.11.41.20", "66.163.114.54", "185.115.164.60", "209.54.103.155", "27.102.118.100", "103.11.41.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.11.41.20", "66.163.114.54", "185.115.164.60", "209.54.103.155", "27.102.118.100", "103.11.41.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Endpoint Security Agent Updates and Policy Syncs
remcos_installer.exe IOC while running under the service account NT SERVICE\DefenderSvc.C:\Program Files\CrowdStrike\csagent.exe) or where the user context is a system service account (SYSTEM, Local Service) rather than an interactive logged-on user.IT Asset Management and Patch Deployment Tools
Remcos_Patch_Check running under the DOMAIN\IT-Admins group might execute a legitimate utility that matches the Remcos network beacon IOC, particularly if the tool uses similar port communication patterns (e.g., HTTPS on 443) to an internal repository.C:\Program Files\Microsoft Configuration Manager or C:\Program Files\Ivanti, and restrict alerts to only trigger when the source IP is external (non-corporate subnet).Remote Support and Helpdesk Sessions