Remcos RAT Spawning svchost.exe, rmclient.exe, or fsutil.exe as Child Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects common suspicious child processes spawned by identified Remcos RAT binaries (remcos.exe or remcos_all_enabled_watchdog.exe). This rule monitors for potentially malicious process execution patterns, such as command shell abuse or unauthorized system tool usage, which are indicative of post-exploitation activity by the Remcos Remote Access Trojan.