Remcos RAT Process Hollowing into Default Browser via Steganographic Loader
Detects Remcos RAT using process hollowing to inject into the default browser executable. The loader chain originates from a TuglaInsaatci-masquerading executable and passes through in-memory DLL stages (Optimax.dll / System Optimizer Ultimate.dll) before hollowing the browser. The Remcos_Mutex_Inj mutex confirms successful injection into the browser process.
Microsoft Sentinel (KQL)
