remcos.yml

name: Remcos
id: 2bd4aa08-b9a5-40cf-bfe5-7d43f13d496c
version: 1
date: '2021-09-23'
author: Teoderick Contreras, Splunk
description: Leverage searches that allow you to detect and investigate unusual activities
  that might relate to the Remcos RAT trojan, including looking for file writes associated
  with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection..
narrative: Remcos or Remote Control and Surveillance, marketed as a legitimate software for 
  remotely managing Windows systems is now widely used in multiple malicious campaigns both APT and commodity malware by threat actors.
references:
- https://success.trendmicro.com/solution/1123281-remcos-malware-information
- https://attack.mitre.org/software/S0332/
- https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos#:~:text=Remcos%20(acronym%20of%20Remote%20Control,used%20to%20remotely%20control%20computers.&text=Remcos%20can%20be%20used%20for,been%20used%20in%20hacking%20campaigns.
tags:
  analytic_story: Remcos
  category:
  - Malware
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  usecase: Advanced Threat Detection