Remcos RAT Process Hollowing into iexplore.exe or ieinstal.exe
Detects suspicious cross-process access or injection activity targeting Internet Explorer-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe). The rule monitors for high-privileged access rights, non-standard source process paths, and the presence of memory-related API calls often associated with process hollowing or injection (e.g., ZwCreateSection, VirtualAlloc, SetThreadContext) in combination with repeated access attempts.
Splunk (SPL)
