rat
Remcos
Named by 1 report, 7 detection rules, 0 IOC feeds.
Also written as: Remcos RAT. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
Remcos RAT OpenDirectory Campaign
RAT_Remcos_Family_Detection, RAT_Remcos_OpenDirectory_Mutex_Install, RAT_Remcos_UAC_Bypass_Persistence, RAT_Remcos_Process_Injection_Mutex_Anchored, RAT_Remcos_Surveillance_LogStrings_Anchored, RAT_Remcos_Process_Injection_Generic_APIs, RAT_Remcos_Surveillance_Generic_API_Cluster
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.