BQTLock Anti-Analysis, Sandbox Evasion and Remcos RAT Stager Detection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•5

This rule detects multiple behavioral indicators associated with malware deployment, including PyInstaller environment artifacts, reconnaissance via system utilities (wmic, tasklist), and suspicious process hollowing/stager chains (e.g., mshta/wscript/cscript invoking PowerShell followed by payload execution from temporary directories). These behaviors are often associated with loaders like BQTLock and Remcos.