Remcos RAT Loader - Privilege Escalation via Token Impersonation

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

Detects potential privilege escalation attempts by the Remcos RAT loader using token impersonation. The rule looks for process command lines containing keywords related to token manipulation ('impersonate', 'token', 'duplicate', 'SeImpersonate', 'logon') specifically when the initiating process is identified as 'Remcos'.