Potential REMCOS Trojan Execution

About

Tags

Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: Command and ControlData Source: Elastic EndgameData Source: Elastic DefendData Source: SysmonData Source: SentinelOneData Source: Microsoft Defender for EndpointData Source: Windows Security Event LogsLanguage: eql

Severity

high

Risk Score

73

MITRE ATT&CK™

Command and Control (TA0011)(opens in a new tab or window)

↳ Remote Access Tools (T1219)(opens in a new tab or window)

License

Elastic License v2(opens in a new tab or window)

Definition

Rule Type

Event Correlation Rule

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

endgame-*logs-endpoint.events.registry-*logs-endpoint.events.file-*logs-m365_defender.event-*logs-sentinel_one_cloud_funnel.*logs-system.security*logs-windows.sysmon_operational-*winlogbeat-*

Related Integrations

endpoint(opens in a new tab or window)

windows(opens in a new tab or window)

sentinel_one_cloud_funnel(opens in a new tab or window)

m365_defender(opens in a new tab or window)

system(opens in a new tab or window)

Query

any where host.os.type == "windows" and
(
 (event.category == "file" and event.type == "deletion" and file.path like "C:\\Users\\*\\AppData\\Local\\Temp\\TH????.tmp") or

 (event.category == "file" and file.path : "?:\\Users\\*\\AppData\\Roaming\\remcos\\logs.dat") or

 (event.category == "registry" and
  registry.value : ("Remcos", "Rmc-??????", "licence") and
  registry.path : (
      "*\\Windows\\CurrentVersion\\Run\\Remcos",
      "*\\Windows\\CurrentVersion\\Run\\Rmc-??????",
      "*\\SOFTWARE\\Remcos-*\\licence",
      "*\\Software\\Rmc-??????\\licence"
  )
 )
)