detect Remcos in memory

Hunt Hypothesis

This detection rule identifies the presence of the Remcos remote access trojan within system memory to uncover stealthy adversary persistence and command-and-control activities. Proactively hunting for this behavior in Azure Sentinel is critical because early identification of in-memory RATs allows the SOC team to mitigate data exfiltration risks before the malware establishes a foothold or escalates privileges.

YARA Rule

rule Remcos {
          meta:
            description = "detect Remcos in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            hash1 = "7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5"

          strings:
            $remcos = "Remcos" ascii fullword
            $url = "Breaking-Security.Net" ascii fullword
            $resource = "SETTINGS" wide fullword
          condition:  all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detect Remcos in memory rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Endpoint Protection Scanning with Embedded Agents

  • Context: Enterprise EDR solutions like CrowdStrike Falcon, SentinelOne, or Carbon Black often inject their own telemetry agents into memory to scan running processes. These agents may load dynamic libraries (DLLs) that share cryptographic hashes, memory signatures, or specific API call sequences with the Remcos RAT, leading to a match on the “in-memory” detection logic.
  • Suggested Filter: Create an exclusion for known EDR service executables and their associated DLL paths. Specifically, whitelist processes running under C:\Program Files\CrowdStrike\ or C:\SentinelOne\CyberAgent\ where the parent process is the primary security daemon (e.g., csagent.exe, sentinel-agent.exe).

• Scenario: Scheduled Remote Administration Tasks

  • Context: IT Operations teams frequently use tools like Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager to deploy patches and run remote scripts. These tools often spawn temporary instances of powershell.exe or cmd.exe that load specific .NET assemblies for remote communication. If the detection logic flags specific memory structures used by these management agents, it may misidentify them as Remcos.
  • Suggested Filter: Exclude processes initiated by scheduled tasks with specific names (e.g., “CCMExec”, “IvantiAgent”) or those running under the SYSTEM account with a parent process of TaskScheduler.exe. Additionally, filter out memory events where the command line contains known enterprise management parameters like /deploy, /patch, or specific SCCM package IDs.

• **Scenario: Virtualization and Hypervisor Tooling