Remcos RAT Encrypted C2 Beaconing on Ports 2404 or 4782

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects network connections on non-standard ports (2404, 4782) that are commonly associated with the Remcos Remote Access Trojan (RAT). It monitors outbound connections from suspicious process names or paths, such as those found in ProgramData, AppData, or Temp directories, and filters out internal RFC-1918 traffic.