Remcos RAT Process Injection into IE/svchost/explorer via Suspended Process
Detects behavior indicative of the Remcos RAT injecting its code into legitimate Windows processes (such as iexplore.exe, ieinstal.exe, ielowutil.exe, svchost.exe, or explorer.exe). The rule identifies this by monitoring for a process matching the Remcos naming convention that launches a secondary process in a suspended state, followed by cross-process activity that deviates from standard system behavior.
YARA-L
