Remcos Watchdog Injection into svchost/rmclient/fsutil with WD Registry Marker
Detects the behavior of the Remcos RAT watchdog process, which monitors the main malware execution. The rule identifies the creation of a specific registry marker (HKCU\SOFTWARE\{MUTEX}\WD) used by the watchdog for state tracking, combined with the malicious process spawning a target executable (svchost.exe, rmclient.exe, or fsutil.exe) from a standard Remcos installation directory.
YARA-L
