REMCOS RAT payload execution - Ethereum transition campaign

Ankit Mehta@Secvyn

•updated Sep 16, 2026•0•0•2

This rule detects the presence or execution of a specific file on a device, identified by its SHA256 hash. The rule monitors both file creation/access and process execution events to identify if a known malicious binary is interacting with the system.