Remcos RAT Loader - Audio and Video Capture Device Access
Detects attempts by the Remcos RAT to access audio and video capture devices (camera, microphone) by monitoring process command lines for keywords related to these devices. It also looks for processes initiated by PowerShell or cmd.exe, which are common methods for malware execution.
Microsoft Sentinel (KQL)
