Remcos or GST-themed Process Attempting Input Capture
Detects processes associated with Remcos RAT or processes with names matching a GST.*.com pattern that are attempting to capture user input by looking for specific API calls or keywords related to keylogging in the process command line. This could indicate an attempt to steal credentials or other sensitive information.
Microsoft Sentinel (KQL)
