Prinz Eugen: RemotePC (RPCCMDHOST.EXE) Spawning PowerShell Stager

Ethan Andrews@eandrews

•updated Jun 23, 2026•0•0•3

Detects RemotePC RMM software (REMOTEPCSERVICE.EXE / RPCCMDHOST.EXE) spawning PowerShell with hidden window and IEX download cradle, consistent with Prinz Eugen ransomware group using RemotePC as a persistence and C2 channel.