REMCOS Malware Signature Detection

Luís Marques@remotecodeexecution

•updated Apr 2, 2026•1•0•90

This rule goes after the behauviour of a variant of REMCOS, a remote access trojan (RAT) that has been observed in the wild. The rule looks for specific indicators of compromise (IOCs) and behaviors associated with this malware, such as unusual process creation patterns, network connections to known command and control (C2) servers, and specific file modifications.