Query Details

Remcos RAT checking for geolocation through web

Remcos Rat Checking For Geolocation

Query

// Define browser executable filenames
let Browser = dynamic(["firefox.exe", "msedge.exe", "chrome.exe", "opera.exe", "brave.exe"]);
DeviceNetworkEvents
// Define timeframe 
| where TimeGenerated > ago(30d)
| where not(InitiatingProcessFileName in (['Browser']))
// Define service used to locate geographical information
| where RemoteUrl contains 'geoplugin.net'
| project Timestamp, DeviceName, LocalIP, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessAccountUpn
| sort by Timestamp desc

About this query

Explanation

This query checks for attempts to connect to the website geoplugin[.]net by non-browser applications. It looks for instances where a Remcos RAT payload installed by ModiLoader checks for geolocation through the web. The query can be modified to fit different environments and browsers used. It provides information such as the timestamp, device name, local IP, remote URL, remote IP, remote port, initiating process file name, and initiating process account UPN. The query is useful for detecting potential malicious activity related to geolocation checks.

Details

Michalis Michalos profile picture

Michalis Michalos

Released: August 14, 2023

Tables

DeviceNetworkEvents

Keywords

DevicesIntuneUser

Operators

|letDeviceNetworkEventswhereTimestampagonotinprojectsortbydesccontains

MITRE Techniques

Actions

GitHub