ThreatFox: Remcos IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying the Remcos remote access trojan to establish persistent command-and-control channels within our network infrastructure. Proactively hunting for these specific IOCs in Azure Sentinel is critical to rapidly identify and isolate compromised endpoints before attackers can exfiltrate sensitive data or escalate privileges.

IOC Summary

Malware Family: Remcos Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["23.94.197.120", "62.60.226.68"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["23.94.197.120", "62.60.226.68"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• IT Asset Management Scans by Lansweeper or SCCM

  • Scenario: Enterprise endpoint management tools like Lansweeper, Microsoft SCCM (ConfigMgr), or PDQ Deploy frequently perform deep system inventory scans. These agents often execute background processes that query network shares, check registry keys for software versions, and verify file integrity, mimicking the reconnaissance behavior of Remcos.
  • Filter/Exclusion: Create an exclusion rule to ignore alerts originating from known management agent process names (e.g., LanSweep.exe, ccmexec.exe, pdqagent.exe) or restrict detection to non-workgroup network segments where these agents are not active.

• Scheduled PowerShell Maintenance Scripts

  • Scenario: System administrators often deploy scheduled tasks via Task Scheduler that run PowerShell scripts (.ps1) for routine maintenance, such as clearing temp files, updating group policies, or backing up user profiles. These scripts may spawn child processes (powershell.exe, cmd.exe) that access specific file paths or registry hives identical to the Remcos IOCs.
  • Filter/Exclusion: Filter out alerts where the parent process is TaskScheduler and the command line contains known internal script paths (e.g., C:\Scripts\Maintenance\). Additionally, exclude events occurring during standard maintenance windows (e.g., 02:00–04:00 local time).

• Third-Party Antivirus Heuristic Scans

  • Scenario: Endpoint Detection and Response (EDR) or Antivirus solutions like CrowdStrike, SentinelOne, or Symantec Endpoint Protection perform heuristic analysis