Remcos RAT Watchdog Process Spawning svchost/rmclient/fsutil for Injection
Detects anomalous behaviors associated with the Remcos RAT watchdog, specifically the execution of host processes (svchost.exe, rmclient.exe, fsutil.exe) by non-standard parent processes, the creation of specific 'WD' or 'exepath' registry keys in HKCU\SOFTWARE used for persistence configuration, and rapid respawn patterns indicating a watchdog process restart loop.
Microsoft Sentinel (KQL)
