Elastic Defend high stable eql

Remcos RAT Registry or File Modification

Identifies registry and file system activity consistent with the Remcos Remote Access Trojan (RAT). Remcos RAT is used by attackers to perform actions on infected machines remotely.

View Source

Detection Logic

any where event.category in ("registry", "file") and
  (
    registry.path : (
      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Remcos",
      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Remcos-*\\licence",
      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Remcos-*\\exepath",
      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Remcos",
      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\Remcos-*\\licence",
      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\Remcos-*\\exepath"
      ) or
    file.path : "?:\\Users\\*\\AppData\\Roaming\\remcos\\logs.dat"
   )

Field Validations

Loading…

Comments (0)

Loading comments...