Remcos CMSTPLUA COM UAC Bypass Spawning Elevated iexplore/ieinstal/ielowutil
Detects potential Remcos RAT activity utilizing the CMSTPLUA COM interface for UAC bypass. The rule identifies instances where suspicious processes (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed from non-standard locations such as ProgramData, AppData, or Temp folders, which is characteristic of Remcos execution flows.
Cortex XDR
