Remcos RAT Loader - Chrome/Firefox Credential Extraction
This rule detects suspicious process activity indicative of the Remcos RAT attempting to extract credentials from web browsers like Chrome, Firefox, or Opera. It specifically looks for `Remcos` related processes initiating browser executables with command-line arguments often associated with credential dumping or unusual browser behavior, such as `--allow-file-access`, `--no-sandbox`, `--headless`, or referencing a 'profile'.
Microsoft Sentinel (KQL)
