Remcos RAT Watchdog Process Spawning svchost/rmclient/fsutil as Injected Monitor

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects anomalous process execution patterns associated with Remcos RAT, specifically monitoring for the spawning of 'rmclient.exe', unauthorized spawning of 'fsutil.exe', or 'svchost.exe' being launched by processes other than system-critical services. These patterns are characteristic of Remcos RAT deploying its watchdog or performing process injection.