Gst Remcos RAT Loader - Steganographic Payload Extraction
This rule detects suspicious process command lines that indicate the extraction of steganographically hidden payloads, potentially associated with the Remcos RAT. It specifically looks for processes with 'GST' in their name or initiating process file name, combined with keywords related to bitmap or image resource manipulation in the command line.
Microsoft Sentinel (KQL)
