Gst Remcos RAT Loader Infrastructure Pattern
Detects network connections to known IP addresses associated with Remcos RAT loader infrastructure, identified by specific URL patterns indicative of loader-as-a-service operations. The rule triggers if a device makes 3 or more requests to these URLs within an hour.
Microsoft Sentinel (KQL)
