This hunt targets adversary behavior consistent with the Remcos remote access trojan by actively searching for network and host indicators across the defined set of 16 known IOCs. Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage infections before they establish persistence, thereby preventing potential data exfiltration or lateral movement within the enterprise environment.
Malware Family: Remcos Total IOCs: 16 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 103[.]67[.]196[.]151:57978 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 91[.]92[.]242[.]180:1880 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 88[.]151[.]72[.]143:8443 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 84[.]247[.]142[.]79:8877 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 62[.]60[.]226[.]157:1664 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 45[.]74[.]7[.]194:9405 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 45[.]74[.]7[.]196:7312 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 31[.]57[.]216[.]62:14642 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 31[.]57[.]216[.]62:14643 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 31[.]57[.]216[.]62:14645 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 216[.]9[.]225[.]38:14644 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 186[.]169[.]89[.]64:5471 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 103[.]11[.]41[.]19:55661 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 147[.]124[.]212[.]185:2404 | botnet_cc | 2026-07-09 | 75% |
| domain | julyblessed634.duckdns.org | botnet_cc | 2026-07-09 | 75% |
| domain | magicmike26.myddns.me | botnet_cc | 2026-07-09 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["31.57.216.62", "186.169.89.64", "216.9.225.38", "84.247.142.79", "88.151.72.143", "62.60.226.157", "45.74.7.194", "147.124.212.185", "103.11.41.19", "103.67.196.151", "45.74.7.196", "91.92.242.180"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.57.216.62", "186.169.89.64", "216.9.225.38", "84.247.142.79", "88.151.72.143", "62.60.226.157", "45.74.7.194", "147.124.212.185", "103.11.41.19", "103.67.196.151", "45.74.7.196", "91.92.242.180"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["julyblessed634.duckdns.org", "magicmike26.myddns.me"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Remcos IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Security Team Manual IOC Hunting: Security analysts frequently run manual threat hunts using tools like Velociraptor, Sysmon, or Microsoft Defender for Endpoint (MDE) to validate new intelligence feeds. When these agents query the network for known Remcos hashes, IP addresses, or domain names, they generate traffic and process events that match the detection logic.
Security-Admins group) and Process Name (e.g., velociraptor-agent.exe, MsMpEng.exe) to suppress alerts originating from authorized security scanning activities.Enterprise Antivirus Signature Updates: The organization’s endpoint protection solution, such as CrowdStrike Falcon, Carbon Black, or SentinelOne, regularly downloads and installs new virus definitions that include Remcos signatures. During the update cycle, these agents may spawn temporary processes to verify IOCs against the local file system, triggering a match on the 16 specific indicators.
csagent.exe, cb.exe) and the Event Type indicates “Signature Update” or “Definition Sync,” provided the action is limited to file scanning rather than network communication.Scheduled Compliance and Asset Inventory Scans: Automated asset management tools like ** Lansweeper**, ServiceNow Discovery, or SolarWinds NPM run scheduled jobs (e.g., nightly at 02:00 UTC) to inventory software versions and check for known vulnerabilities. These scanners often probe endpoints against a database of malware IOCs, including Rem