Remcos RAT Process Injection into Legitimate Windows Host Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects behavior patterns consistent with Remcos RAT, specifically: 1) unauthorized process injection (CreateRemoteThread/ProcessInjection) into common host processes, 2) spawning of browser-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe) from non-standard parent processes, and 3) anomalous outbound network connections from these injected processes over non-standard ports.