REMCOS Injection into Suspended iexplore.exe/ieinstal.exe via Section Mapping

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects cross-process injection activity targeting Internet Explorer related processes (iexplore.exe, ieinstal.exe, ielowutil.exe). The rule monitors for unauthorized processes that are not signed by trusted publishers (Microsoft, Google, Mozilla) performing injection-like behavior, typically associated with Remcos RAT and its use of techniques such as process hollowing or thread execution hijacking.