Remcos RAT Remote Shell Execution: cmd.exe or PowerShell Spawned by Remcos Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the execution of command shells (cmd, powershell, pwsh) spawned by the Remcos Remote Access Trojan (RAT), typically located in ProgramData or executing as remcos.exe. The rule monitors for command-line arguments indicative of script execution.