Remcos RAT Browser & Windows Credential Store Theft

Duo Tech@duotech

•updated Jun 22, 2026•1•0•5

This rule detects attempts by non-browser processes to access sensitive files that commonly contain credentials, such as browser login data (Chrome, Firefox) or the Windows Security Account Manager (SAM) database. This activity could indicate credential dumping or information theft.