Remcos Masqueraded Directory Creation with Trailing Space
Detects the creation of a directory with a trailing space in its name (e.g., "C:\Windows \") using the NT path prefix `\\?\`. This technique was observed in a Remcos malware campaign in June 2025 to masquerade as a legitimate system directory like `C:\Windows\SysWOW64` to evade detection.
Sigma
