Remcos RAT Process Injection into iexplore.exe, svchost.exe, or fsutil.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of known Remcos Remote Access Trojan (RAT) watchdog processes (e.g., iexplore.exe, svchost.exe, fsutil.exe) when spawned by suspicious parent processes or running from non-standard file paths such as Temp, AppData, or ProgramData, which are common indicators of malicious activity.