Remcos RAT Campaign Detection
This rule detects various stages of the Remcos RAT campaign. It includes rules for initial access via Word documents with remote templates and RTF files exploiting CVE-2017-11882, VBScript loaders executing Base64-encoded PowerShell, .NET modules used for loading and persistence via scheduled tasks, the Remcos RAT payload itself (version 7.0.4 Pro) including indicators of process hollowing, network indicators for C2 communication, fileless execution techniques (PowerShell loading .NET from image, process hollowing), and persistence mechanisms like scheduled tasks and VBScript files in public downloads.
YARA
