Remcos RAT Process Injection into iexplore.exe, ieinstal.exe, or ielowutil.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects potential process injection behavior associated with the Remcos Remote Access Tool. It monitors for suspicious parent-child process relationships where 'remcos.exe' is identified as a parent of 'svchost.exe' or 'explorer.exe', or where Internet Explorer components (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed in a manner inconsistent with typical Windows system process hierarchies.