Remcos File Attribute Hiding and Self-Delete via attrib.exe or icacls.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects indicators of Remcos RAT activity, specifically focusing on its use of native Windows utilities like attrib.exe, icacls.exe, and cmd.exe to modify file attributes, alter access control lists, or facilitate self-deletion. The rule also triggers when a identified Remcos-related process directly spawns these administrative tools for evasive actions.