Remcos RAT Loader - Inline C# Code Compilation

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•4

Detects the execution of inline C# code compilation, often used by malware like Remcos RAT, when initiated by PowerShell or a process with 'Remcos' in its parent's filename. This rule specifically looks for command-line arguments indicative of C# compilation (csc.exe, csc.compiler, CodeCompile, CompileAssemblyFromSource) in conjunction with suspicious initiating processes.