Remcos RAT Loader Sandbox Evasion Attempt

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

This rule detects attempts by a process, potentially a Remcos RAT loader identified by 'GST*.com' or 'GST' in its command line, to evade sandbox or virtual machine environments. It looks for the presence of common sandbox/VM indicators in the command line.