Remcos RAT Multi-Stage Dropper Chain via Office Parent Process

Duo Tech@duotech

•updated Jun 22, 2026•0•0•3

This rule detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook, Publisher, Access, OneNote) spawn scripting or command interpreter processes such as PowerShell, WScript, CScript, Mshta, Regsvr32, or Cmd.exe. This behavior is often indicative of malicious activity, such as macro-enabled malware executing payloads or exploiting vulnerabilities.