Detection Rules — Remcos RAT OpenDirectory Campaign

Campaign: OpenDirectory-203.159.90.147-Remcos Date: 2026-02-04 Author: The Hunters Ledger License: CC BY 4.0 Reference: https://the-hunters-ledger.com/reports/remcos-opendirectory/

Detection Coverage Summary

Remcos is a commercially-sold remote access trojan (Breaking-Security.Net) widely repurposed as off-the-shelf RAT tooling. This campaign distributed it via an open directory at 203.159.90.147, using a VB6-compiled dropper (Payload.exe) to stage a UAC-bypassing, Winlogon-persistent Remcos payload (Backdoor.exe / remcos.exe) with keylogging, screenshot, audio-recording, clipboard-monitoring, and browser-credential-theft capability. Coverage here is anchored on the family mutex Remcos_Mutex_Inj and the Winlogon Userinit hijack (both durable, near-zero-FP indicators) while a number of originally-published rules that keyed on generic Windows APIs, common registry/file paths, or the operator-configurable install folder name have been re-tiered to Hunting or salvaged into tighter mutex-anchored Detection companions. The campaign’s C2 IP and download URLs are carried in the IOC feed rather than as standalone network signatures.

Detection vs Hunting: Detection rules are high-fidelity and evasion-resilient, safe to alert on. Hunting rules are broader, for scoping and threat-hunting. Expect to review the hits.

Highest-confidence anchors:

• Mutex Remcos_Mutex_Inj, durable across builds of this RAT family, near-zero FP, and the primary anchor for two YARA Detection rules and the strongest Sigma-adjacent evidence in the campaign.
• Winlogon Userinit registry hijack (HKLM\...\Winlogon\Userinit) and the resulting suspicious winlogon.exe child process, technique-level chokepoints with essentially no legitimate collision, covered by two Detection-tier Sigma rules.

Atomics routed to the IOC feed: the C2/distribution IP 203.159.90.147, its two malware-download URLs, and the sample hashes were already present in /ioc-feeds/remcos-opendirectory-campaign.json from the original analysis. Three network-only rule candidates (one Sigma, two Suricata rule-objects covering three signatures) that keyed solely on this IP have been retired in favor of the feed entry rather than duplicated as standalone rules. No feed edits were required.

YARA Rules

Detection Rules

Remcos RAT Family Detection

Tier: Detection Robustness: 2 ATT&CK Coverage: T1219 (Remote Access Software), T1056.001 (Keylogging), T1555.003 (Web Browsers), T1113 (Screen Capture) ATT&CK Note: T1219 is the primary mapping; T1056.001, T1555.003, and T1113 are secondary coverage. Confidence: HIGH False Positives: None known. Every OR-branch requires either the family mutex, the paired product banner + developer string, or a multi-string combination from the RAT’s internal C2/keylogging/credential-theft protocol vocabulary. Logic fix 2026-10-11: the loosest branch used to be 8 of them, and 7 of the 24 declared strings are generic Windows terms (Userinit, install.bat, EnableLUA, VirtualAllocEx, WriteProcessMemory, GdipSaveImageToStream, waveInOpen), so a binary holding all seven plus one Remcos string satisfied it; the branch now also requires 3 of the 17 Remcos-vocabulary strings (mutex, banner, developer, C2, keylogging, credential and command strings). Not goodware-validated. Blind Spots: A fully re-branded fork that strips the banner/developer strings, randomizes the mutex, and reworks the internal log/command vocabulary would evade this rule; targets files and saved dumps, not network traffic; the condition tests filesize and an MZ header, which a libyara live process-memory scan cannot satisfy. Validation: Scan either analyzed sample (hash1/hash3 below) — must match via the mutex branch alone (replay against the samples is NOT CHECKED); a benign, unrelated Windows executable must NOT fire. Deployment: Endpoint AV/EDR file scan, of files or saved dumps. Live process-memory scanning is not covered: the filesize test is undefined there.

/*
   Yara Rule Set
   Identifier: Remcos RAT OpenDirectory Campaign (203.159.90.147)
   Author: The Hunters Ledger
   Source: https://the-hunters-ledger.com/
   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
*/

rule RAT_Remcos_Family_Detection {
   meta:
      description = "Detects Remcos RAT via its mutex, C2 protocol banner, and internal log/command strings - a multi-branch fingerprint of the Remcos family's mutex, banner, C2, keylogging, credential and command strings, which matches only while at least one branch's strings survive in the build"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/"
      date = "2026-02-04"
      hash1 = "ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82"
      hash2 = "45aa592f3b30ef526e380978338718f540cff5d2"
      hash3 = "04693af3b0a7c9788daba8e35f429ba6"
      family = "Remcos"
      malware_type = "RAT"
      campaign = "OpenDirectory-203.159.90.147-Remcos"
      id = "32642d64-41b4-5b64-801e-c295f9bfe4a9"
   strings:
      $mutex = "Remcos_Mutex_Inj" ascii wide
      $banner = " * REMCOS v" ascii
      $developer = "Breaking-Security.Net" ascii

      $c2_1 = "Connected to C&C!" ascii
      $c2_2 = "[KeepAlive]" ascii
      $c2_3 = "[DataStart]" ascii

      $keylog_1 = "onlinelogs" ascii
      $keylog_2 = "offlinelogs" ascii
      $keylog_3 = " [Ctrl + V]" ascii
      $keylog_4 = "[Following text has been copied to clipboard:]" ascii
      $keylog_5 = "[Following text has been pasted from clipboard:]" ascii

      $cred_1 = "[Chrome StoredLogins found, cleared!]" ascii
      $cred_2 = "[Firefox StoredLogins cleared!]" ascii
      $cred_3 = "[Chrome Cookies found, cleared!]" ascii

      $persist_1 = "Userinit" ascii
      $persist_2 = "install.bat" ascii
      $persist_3 = "EnableLUA" ascii

      $cmd_1 = "consolecmd" ascii
      $cmd_2 = "remscriptexecd" ascii
      $cmd_3 = "getproclist" ascii

      $api_inject_1 = "VirtualAllocEx" ascii
      $api_inject_2 = "WriteProcessMemory" ascii
      $api_screen = "GdipSaveImageToStream" ascii
      $api_audio = "waveInOpen" ascii
   condition:
      uint16(0) == 0x5A4D and
      filesize < 5MB and
      (
         $mutex or
         ($banner and $developer) or
         (3 of ($c2_*)) or
         (2 of ($keylog_*) and 2 of ($api_*)) or
         (2 of ($cred_*)) or
         (8 of them and 3 of ($mutex, $banner, $developer, $c2_*, $keylog_*, $cred_*, $cmd_*))
      )
}

Remcos OpenDirectory Campaign Mutex and Install Artifacts

Tier: Detection Robustness: 3 ATT&CK Coverage: T1548.002 (Bypass User Account Control), T1555.003 (Web Browsers), T1070.004 (File Deletion) Confidence: HIGH Rationale: Salvaged from the original campaign-specific rule, which OR’d the durable mutex against the generic window class name MsgWindowClass (the underlying IOC feed itself documents this window class as “false_positive_risk: High… confidence: LOW”). Tightened so $mutex is now a mandatory AND-term rather than an optional OR-branch, and the two exact-hash OR-clauses were removed — both hashes are already recorded in this rule’s own hash1/hash3 meta fields and in the IOC feed, so a redundant in-condition hash check added nothing (see the yara-rule-formatting skill’s hash guidance). False Positives: None known — every surviving branch requires the family mutex plus one of four campaign-specific combinations: the remcos install path with the dropped temp DLL name, the Chrome and Firefox profile paths together, install.bat with the ping delay, or the exact UAC-bypass command fragment. Blind Spots: A build that randomizes the mutex evades entirely; the install-path/temp-DLL/install.bat branches are brittle on their own (operator-configurable) but are gated behind the mutex requirement here. Validation: Scan either analyzed sample — must match; a benign binary that coincidentally references EnableLUA or a Chrome/Firefox path (e.g. a legitimate browser-migration tool) must NOT fire absent the mutex. Deployment: Endpoint AV/EDR file scan, scanning of saved dumps. Live process-memory scanning does not match: the condition’s filesize test is undefined there, so only files and saved dumps are scanned.

rule RAT_Remcos_OpenDirectory_Mutex_Install {
   meta:
      description = "Detects Remcos RAT samples from the OpenDirectory 203.159.90.147 campaign via the family mutex Remcos_Mutex_Inj combined with one of the campaign's UAC-bypass, browser-credential-path, or install/melt artifact combinations"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/"
      date = "2026-02-04"
      hash1 = "ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82"
      hash2 = "45aa592f3b30ef526e380978338718f540cff5d2"
      hash3 = "04693af3b0a7c9788daba8e35f429ba6"
      family = "Remcos"
      malware_type = "RAT"
      campaign = "OpenDirectory-203.159.90.147-Remcos"
      id = "393268d2-7545-5cea-ab00-81267cc5747f"
   strings:
      $mutex = "Remcos_Mutex_Inj" ascii wide
      $uac_cmd = "EnableLUA /t REG_DWORD /d 0 /f" ascii wide
      $chrome_path = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" ascii wide
      $firefox_path = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" ascii wide
      $install_path = "\\AppData\\Roaming\\remcos\\remcos.exe" ascii wide
      $temp_dll = "\\Temp\\0.dll" ascii wide
      $install_bat = "install.bat" ascii wide
      $ping_delay = "PING 127.0.0.1 -n 2" ascii wide
   condition:
      uint16(0) == 0x5A4D and
      filesize < 2MB and
      $mutex and
      (
         $uac_cmd or
         ($chrome_path and $firefox_path) or
         ($install_path and $temp_dll) or
         ($install_bat and $ping_delay)
      )
}

Remcos UAC Bypass and Persistence

Tier: Detection Robustness: 2 ATT&CK Coverage: T1548.002 (Bypass User Account Control), T1547.001 (Registry Run Keys / Startup Folder), T1547.004 (Winlogon Helper DLL) Confidence: HIGH Rationale: Every OR-branch requires either the family mutex or the literal AppData\Roaming\remcos\remcos.exe install path; none of the five branches can fire on the generic Software\...\Run string alone. The branches are: a UAC command string plus the install path; three persistence-path strings plus the install path; the Userinit path, the install path and the mutex; the mutex plus two persistence-path strings plus a UAC command string (this one needs no install path); and the PING and install.bat melting strings plus the install path. Fixed a real defect from the original: the condition had no filesize constraint at all. Wording fix 2026-10-11: the earlier text said the Run string only contributes with the install path, which is untrue of the mutex branch. False Positives: None known. The generic Software\Microsoft\Windows\CurrentVersion\Run string only contributes when paired with the campaign install path, or (the fourth branch) with the family mutex plus a second persistence-path string plus a UAC command string; it never fires alone. Not goodware-validated. Blind Spots: A build using a differently-named install folder AND a randomized mutex evades every branch; targets on-disk artifacts only. Validation: Scan either analyzed sample — it must satisfy at least one of the five branches, for example the Userinit path, the install path and the mutex together (the mutex and the Userinit path alone are not enough, and replay against the samples is NOT CHECKED); a legitimate administrative script referencing the Run key alone (without the campaign install path) must NOT fire. Deployment: Endpoint AV/EDR file scan.

rule RAT_Remcos_UAC_Bypass_Persistence {
   meta:
      description = "Detects Remcos RAT UAC-bypass and persistence mechanisms via reg.exe EnableLUA modification, Winlogon/Run-key persistence paths, and the mutex Remcos_Mutex_Inj, each branch anchored on the campaign's default install path or the family mutex"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/"
      date = "2026-02-04"
      hash1 = "ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82"
      hash2 = "45aa592f3b30ef526e380978338718f540cff5d2"
      hash3 = "04693af3b0a7c9788daba8e35f429ba6"
      family = "Remcos"
      malware_type = "RAT"
      campaign = "OpenDirectory-203.159.90.147-Remcos"
      id = "e53a05eb-deea-575f-bb7d-2a97e8d63bf0"
   strings:
      $uac_cmd_1 = "reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA" ascii wide
      $uac_cmd_2 = "EnableLUA /t REG_DWORD /d 0 /f" ascii wide
      $persist_1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
      $persist_2 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit" ascii wide
      $persist_3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run" ascii wide
      $install_path = "AppData\\Roaming\\remcos\\remcos.exe" ascii wide
      $melt_1 = "PING 127.0.0.1 -n 2" ascii wide
      $melt_3 = "install.bat" ascii wide
      $remcos_mutex = "Remcos_Mutex_Inj" ascii
   condition:
      uint16(0) == 0x5A4D and
      filesize < 5MB and
      (
         (any of ($uac_cmd_*) and $install_path) or
         (3 of ($persist_*) and $install_path) or
         ($persist_2 and $install_path and $remcos_mutex) or
         ($remcos_mutex and 2 of ($persist_*) and any of ($uac_cmd_*)) or
         ($melt_1 and $melt_3 and $install_path)
      )
}

Remcos Process Injection (Mutex-Anchored)

Tier: Detection Robustness: 3 ATT&CK Coverage: T1055 (Process Injection) Confidence: HIGH Rationale: Split from the original combined injection rule, which OR’d this mutex-anchored branch against two fully-generic branches (a bare 5-of-6 classic injection API cluster, and a desktop.ini-triggered branch the IOC feed itself flags “false_positive_risk: High (normal folder operations)… confidence: MODERATE/LOW”). Isolating the mutex-anchored branch as its own rule preserves genuine Detection-grade precision; the generic branches are preserved separately as a Hunting rule below rather than dropped. False Positives: None known — the mutex is a distinctive family identifier not shared with legitimate software. Blind Spots: A build that randomizes the mutex evades this rule (the Hunting-tier generic-API companion below still applies, with higher noise). Validation: Scan either analyzed sample — must match; a legitimate debugger or EDR agent using the same injection APIs but lacking the mutex must NOT fire. Deployment: Endpoint AV/EDR file scan, scanning of saved dumps. Live process-memory scanning does not match: the condition’s filesize test is undefined there, so only files and saved dumps are scanned.

rule RAT_Remcos_Process_Injection_Mutex_Anchored {
   meta:
      description = "Detects the Remcos RAT process-injection module via the family mutex Remcos_Mutex_Inj combined with 4 or more of its classic injection API imports (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, GetThreadContext, SetThreadContext, ResumeThread)"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/"
      date = "2026-02-04"
      hash1 = "ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82"
      hash2 = "45aa592f3b30ef526e380978338718f540cff5d2"
      hash3 = "04693af3b0a7c9788daba8e35f429ba6"
      family = "Remcos"
      malware_type = "RAT"
      campaign = "OpenDirectory-203.159.90.147-Remcos"
      id = "111690c6-c6a5-50fa-8f4b-1ea9c431e4f6"
   strings:
      $api_1 = "VirtualAllocEx" ascii
      $api_2 = "WriteProcessMemory" ascii
      $api_3 = "CreateRemoteThread" ascii
      $api_4 = "GetThreadContext" ascii
      $api_5 = "SetThreadContext" ascii
      $api_6 = "ResumeThread" ascii
      $remcos_mutex = "Remcos_Mutex_Inj" ascii
   condition:
      uint16(0) == 0x5A4D and
      filesize < 5MB and
      $remcos_mutex and
      4 of ($api_*)
}

Remcos Surveillance Module (Log-String Anchored)

Tier: Detection Robustness: 2 ATT&CK Coverage: T1056.001 (Keylogging), T1115 (Clipboard Data) Confidence: HIGH Rationale: Split from the original combined surveillance rule to isolate the two branches anchored on the distinctive onlinelogs/offlinelogs/[Ctrl + V] internal log-naming vocabulary from a fully-generic hook+screen+audio API cluster (preserved separately as a Hunting rule below). False Positives: None known — onlinelogs/offlinelogs are distinctive internal folder-naming strings not observed in unrelated software. Blind Spots: A build that renames the internal log-folder strings evades this rule. Validation: Scan either analyzed sample — must match; a legitimate clipboard-manager or accessibility tool using GetClipboardData/SetWindowsHookExA alone (without the log-naming strings) must NOT fire. Deployment: Endpoint AV/EDR file scan.

rule RAT_Remcos_Surveillance_LogStrings_Anchored {
   meta:
      description = "Detects the Remcos RAT surveillance module via its distinctive internal log-folder naming (onlinelogs/offlinelogs) and clipboard-annotation string combined with keyboard-hook, clipboard, or idle-detection APIs"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/"
      date = "2026-02-04"
      hash1 = "ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82"
      hash2 = "45aa592f3b30ef526e380978338718f540cff5d2"
      hash3 = "04693af3b0a7c9788daba8e35f429ba6"
      family = "Remcos"
      malware_type = "RAT"
      campaign = "OpenDirectory-203.159.90.147-Remcos"
      id = "679e4b7b-2853-544e-9fad-c4c867973d02"
   strings:
      $keylog_api_1 = "SetWindowsHookExA" ascii
      $clip_api_1 = "GetClipboardData" ascii
      $activity_1 = "GetLastInputInfo" ascii
      $surv_str_1 = "onlinelogs" ascii
      $surv_str_2 = "offlinelogs" ascii
      $surv_str_3 = "[Ctrl + V]" ascii
   condition:
      uint16(0) == 0x5A4D and
      filesize < 5MB and
      (
         ($keylog_api_1 and $clip_api_1 and 2 of ($surv_str_*)) or
         (3 of ($surv_str_*) and $activity_1)
      )
}

Hunting Rules

Remcos Process Injection (Generic API Cluster)

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1055 (Process Injection) Confidence: MODERATE Rationale: Every string in this rule is a standard Windows API name or a common process name (explorer.exe, msedge.exe) or the ubiquitous desktop.ini filename — none is Remcos-specific. This is a real, broad injection-technique signal worth analyst triage, but it will also match legitimate debuggers, EDR agents, and other injection-capable software. False Positives: Legitimate debuggers (x64dbg, WinDbg), EDR/AV agents performing their own hooking, game trainers/cheat engines, and other unrelated injection-capable software. The desktop.ini branch specifically was flagged in the underlying campaign evidence as “false_positive_risk: High (normal folder operations).” Deployment: Endpoint AV/EDR file scan; broader sweep, not for auto-block.

rule RAT_Remcos_Process_Injection_Generic_APIs {
   meta:
      description = "Broad hunting rule for a classic process-injection API cluster (VirtualAllocEx/WriteProcessMemory/CreateRemoteThread/GetThreadContext/SetThreadContext/ResumeThread) combined with references to explorer.exe/msedge.exe or desktop.ini-triggered injection timing; observed in Remcos RAT samples from this campaign but not anchored on a family-specific string, so it will also match unrelated injection-capable software"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/"
      date = "2026-02-04"
      hash1 = "ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82"
      hash2 = "45aa592f3b30ef526e380978338718f540cff5d2"
      hash3 = "04693af3b0a7c9788daba8e35f429ba6"
      family = "Remcos"
      malware_type = "RAT"
      campaign = "OpenDirectory-203.159.90.147-Remcos"
      id = "e3bbbd84-7fb8-5d24-bb57-90ba103a749a"
   strings:
      $api_1 = "VirtualAllocEx" ascii
      $api_2 = "WriteProcessMemory" ascii
      $api_3 = "CreateRemoteThread" ascii
      $api_4 = "GetThreadContext" ascii
      $api_5 = "SetThreadContext" ascii
      $api_6 = "ResumeThread" ascii
      $target_1 = "explorer.exe" ascii wide
      $target_2 = "msedge.exe" ascii wide
      $desktop_ini = "desktop.ini" ascii wide
   condition:
      uint16(0) == 0x5A4D and
      filesize < 5MB and
      (
         (5 of ($api_*) and 2 of ($target_*)) or
         ($desktop_ini and 4 of ($api_*) and $target_1)
      )
}

Remcos Surveillance Module (Generic API Cluster)

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1056.001 (Keylogging), T1113 (Screen Capture), T1123 (Audio Capture) Confidence: MODERATE Rationale: Requires a keyboard hook, a screen-capture API, and an audio-recording API together in one binary — a suspicious combination, but built entirely from standard Windows Multimedia/GDI+/hooking APIs with no Remcos-specific string. False Positives: Legitimate remote-support tools, employee-monitoring/parental-control software, and screen/voice-recording utilities that combine these same three API categories. Deployment: Endpoint AV/EDR file scan; broader sweep, not for auto-block.

rule RAT_Remcos_Surveillance_Generic_API_Cluster {
   meta:
      description = "Broad hunting rule for the combined presence of keyboard-hook, screen-capture, and audio-recording APIs (SetWindowsHookExA, GdipSaveImageToStream/BitBlt, waveInOpen/waveInAddBuffer) in one binary; observed in Remcos RAT samples from this campaign but the API combination alone is also used by legitimate remote-support and employee-monitoring software"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/"
      date = "2026-02-04"
      hash1 = "ebdd31a7622288b15439396a5758ffb0133d28b4bb11e9386187661a4b7d5f82"
      hash2 = "45aa592f3b30ef526e380978338718f540cff5d2"
      hash3 = "04693af3b0a7c9788daba8e35f429ba6"
      family = "Remcos"
      malware_type = "RAT"
      campaign = "OpenDirectory-203.159.90.147-Remcos"
      id = "5525c61f-9bf0-55ef-b6d0-0b15660eef3a"
   strings:
      $keylog_api_1 = "SetWindowsHookExA" ascii
      $screen_api_1 = "GdipSaveImageToStream" ascii
      $screen_api_2 = "BitBlt" ascii
      $audio_api_1 = "waveInOpen" ascii
      $audio_api_2 = "waveInAddBuffer" ascii
   condition:
      uint16(0) == 0x5A4D and
      filesize < 5MB and
      $keylog_api_1 and
      1 of ($screen_api_*) and
      1 of ($audio_api_*)
}

Sigma Rules

Detection Rules

UAC Disabling Attempt by reg.exe Setting EnableLUA to 0 From cmd.exe

Tier: Detection Robustness: 3 ATT&CK Coverage: T1548.002 (Bypass User Account Control) Confidence: HIGH Rationale: Wording and logic fix 2026-10-11: the earlier title said Remcos RAT, but nothing in the selection is Remcos-specific, so the title and description now name the behavior. The value test was the bare substring /d 0, which also matches /d 0x1 (UAC enabled); it is now /d 0 in the middle of the line or /d 0 at its end. Boundary fix 2026-10-11 (round 2): the key and value tests were five unordered substrings, so Policies\SystemBackup or a value named EnableLUABackup also matched; the key and value must now appear as the exact sequence \Policies\System /v EnableLUA (also accepted with a closing quote after System), so the argument order key then /v is required. False Positives: Legitimate system administration (rare); enterprise management tools (SCCM, Intune) performing scripted UAC changes — verify digital signature before treating as benign. Blind Spots: Misses a UAC-disable performed by a process other than reg.exe (e.g. PowerShell Set-ItemProperty) or launched by a parent other than cmd.exe; misses the data written in another spelling (/d 0x0, /d 00, /d 0x00000000) and a command line that puts /v EnableLUA before the key; the event is an attempted change and is not proof the value was written; see the companion registry-state rule below for the registry-write angle. Validation: Trigger the malware’s UAC-bypass routine — the reg.exe command line must match; unrelated administrative reg.exe usage that doesn’t target this exact key/value combination (including Policies\SystemBackup and a value named EnableLUABackup) must NOT fire. Deployment: Endpoint EDR / Sysmon-fed SIEM (process-creation telemetry).

title: UAC Disabling Attempt by reg.exe Setting EnableLUA to 0 From cmd.exe
id: 482a813a-346e-450c-8ff7-4b449a26ad7d
status: experimental
description: >-
  Detects reg.exe, launched by cmd.exe, adding the HKLM Policies\System
  EnableLUA value as REG_DWORD with data 0 (the value written as /d 0 followed
  by a space or ending the line), an attempt to disable User Account Control (the event is the command line, not the resulting registry state; see the companion registry-state rule). The
  report records Remcos doing this ahead of persistence installation. The
  rule has no Remcos-specific test: any cmd.exe-launched reg.exe that turns
  UAC off matches, and so does the same change made by an administrator or a
  management tool.
references:
    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/
author: The Hunters Ledger
date: '2026-02-04'
tags:
    - attack.privilege-escalation
    - attack.t1548.002
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'ADD'
            - 'HKLM'
            - 'REG_DWORD'
    selection_key:
        CommandLine|contains:
            - '\Policies\System /v EnableLUA '
            - '\Policies\System" /v EnableLUA '
    selection_value_mid:
        CommandLine|contains: '/d 0 '
    selection_value_end:
        CommandLine|endswith: '/d 0'
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
    condition: selection_img and selection_cli and selection_key and (selection_value_mid or selection_value_end) and selection_parent
falsepositives:
    - Legitimate system administration (rare)
    - Enterprise management tools (SCCM, Intune) - verify digital signature
level: high

Winlogon Userinit Registry Value Changed From the Default

Tier: Detection Robustness: 3 ATT&CK Coverage: T1547.004 (Winlogon Helper DLL) Confidence: HIGH Rationale: Round 2 fixes 2026-10-11: the value test was contains, so a value named UserinitBackup matched; it is now endswith, which makes the value name exact. level is lowered from critical to high because the false-positive list admits administrators and management tools, and the YAML falsepositives entry that called the value untouched by legitimate processes is replaced to match. The title no longer names Remcos, since nothing in the selection is Remcos-specific. Wording fix 2026-10-11: the earlier description said the rule detects an appended executable path, but the selection fires on any Userinit data other than the exact default string, which includes a replaced value; the description, false positives and validation now say so. False Positives: Unlikely. The report names no legitimate writer of this value outside OS installation; a management tool or an administrator that rewrites it also matches, and so does a legitimate spelling of the default that differs from the filtered string. Blind Spots: A persistence mechanism that avoids Userinit entirely (e.g. a Run key alone) is not covered. The default-value filter is one literal string; a differently formatted default would be reported as a modification. Validation: Trigger the malware’s persistence routine: the registry write appending a second executable path must match; a write that leaves the value as the default userinit.exe, must NOT fire, and a write that replaces it with another value does fire. Deployment: Endpoint EDR / Sysmon-fed SIEM (registry telemetry).

title: Winlogon Userinit Registry Value Changed From the Default
id: 208b4736-f00a-44bd-b71e-1230ece13876
status: experimental
description: >-
  Detects a write to the Winlogon Userinit registry value whose data is
  anything other than the default C:\WINDOWS\system32\userinit.exe, (with
  the trailing comma). The report records Remcos RAT appending its own
  executable path after the default, a rare persistence technique that runs
  the payload at every user logon before the desktop loads. The rule tests
  only that the value differs from the default, so an appended path, a
  replaced value and any other change all match.
references:
    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/
author: The Hunters Ledger
date: '2026-02-04'
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1547.004
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit'
    filter_legitimate:
        Details: 'C:\WINDOWS\system32\userinit.exe,'
    condition: selection and not filter_legitimate
falsepositives:
    - Administrators or management tools that rewrite the Userinit value
    - A legitimate spelling of the default that differs from the filtered string (case, or a missing trailing comma)
level: high

EnableLUA Registry Value Set to Disable User Account Control (Registry State)

Tier: Detection Robustness: 3 ATT&CK Coverage: T1548.002 (Bypass User Account Control) Confidence: HIGH Rationale: Reformatted from a retired KQL hunting query (see Coverage Gaps). Complements the process-creation rule above by catching the resulting registry state change regardless of which process or mechanism performed the write, so it still fires if the operator switches from reg.exe to PowerShell or a different UAC-disable mechanism. False Positives: Legitimate system administration (rare); enterprise management tools (SCCM, Intune, Group Policy) disabling UAC for legacy application compatibility. Blind Spots: Cannot distinguish which process performed the write; pair with the process-creation rule above for attribution. Validation: Trigger the malware’s UAC-bypass routine — the registry value write must match; a system where EnableLUA remains at its default value of 1 must NOT fire. Registry value rendering (round 2, 2026-10-11): raw Sysmon Event 13 renders a DWORD in Details as DWORD (0x........), but the Elastic Sysmon pipeline (logs-windows.sysmon_operational 3.8.3, script “Set registry fields”) writes registry.data.strings as the decimal value with type SZ_DWORD, per the T-0222 registry telemetry proposal (Docs/2026-10-10-anthropic-api-credit/fixes/registry-telemetry-proposal.md). The selection therefore accepts both forms. The decimal form was read from the pipeline script, not from a live event: no Windows endpoint reports to the stack, so neither form has been seen arriving. Deployment: Endpoint EDR / Sysmon-fed SIEM (registry telemetry).

title: EnableLUA Registry Value Set to Disable User Account Control
id: 0ce7475a-f0d5-48fe-bd80-629f9df689aa
status: experimental
description: >-
  Detects the EnableLUA registry value under the system UAC policy key
  being set to 0 (disabled), regardless of which process performs the
  write. Complements the reg.exe process-creation detection for the
  same Remcos RAT UAC-bypass technique by catching the resulting
  registry state change if a different mechanism (e.g. PowerShell
  Set-ItemProperty) performs the write.
references:
    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/
author: The Hunters Ledger
date: '2026-02-04'
modified: '2026-10-11'
tags:
    - attack.privilege-escalation
    - attack.t1548.002
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Policies\System\EnableLUA'
        Details:
            - 'DWORD (0x00000000)'
            - 0
    condition: selection
falsepositives:
    - Legitimate system administration (rare)
    - Enterprise management tools (SCCM, Intune, Group Policy) disabling UAC for legacy application compatibility
level: high

Remcos RAT Inline Self-Deletion cmd.exe Command Line (PING, DEL, Start and Remcos Folder)

Tier: Detection Robustness: 2 ATT&CK Coverage: T1070.004 (File Deletion) Confidence: MODERATE False Positives: Custom administrative scripts that happen to reference the same folder name (very rare pattern). Blind Spots: A cmd.exe started on the script file (cmd /c %TEMP%\install.bat) carries none of the four tokens in its command line and evades; whether the observed run passes the commands inline is NOT CHECKED (the report documents the script content, not the invocation). A build using a differently-named install folder evades the AppData\Roaming\remcos requirement; misses file-melting performed through a mechanism other than cmd.exe. Validation: Run a cmd.exe whose command line holds PING 127.0.0.1, DEL, start and AppData\Roaming\remcos: it must match. A benign script that pings localhost or deletes files without ALSO referencing this exact folder must NOT fire, and cmd /c install.bat must NOT fire (the script body is not on the command line). Deployment: Endpoint EDR / Sysmon-fed SIEM (process-creation telemetry).

title: Remcos RAT Inline Self-Deletion cmd.exe Command Line (PING, DEL, Start and Remcos Folder)
id: 62f7d36c-2d5d-4f21-a6c9-71589b95ddb0
status: experimental
description: >-
  Detects a cmd.exe command line that itself contains a PING 127.0.0.1
  delay, a DEL, a start and the AppData\Roaming\remcos folder, the form of
  the Remcos RAT self-deletion ("file melting") sequence in which the
  commands are passed on the command line. The report records the sequence
  as the content of the %TEMP%\install.bat staging script and does not say how
  cmd.exe was started, so a run that executes install.bat from a file shows
  only the script path on the command line and does not match. The rule does
  not test install.bat.
references:
    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/
author: The Hunters Ledger
date: '2026-02-04'
tags:
    - attack.stealth
    - attack.t1070.004
    - detection.emerging-threats
    - stp.3
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\cmd.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'PING 127.0.0.1'
            - 'DEL'
            - 'start'
            - 'AppData\Roaming\remcos'
    condition: all of selection_*
falsepositives:
    - Custom administrative scripts referencing the same folder name (very rare pattern)
level: high

winlogon.exe Child Process Running From an AppData Path (Userinit Hijack Pattern)

Tier: Detection Robustness: 3 ATT&CK Coverage: T1547.004 (Winlogon Helper DLL) Confidence: HIGH Rationale: Wording and level fix 2026-10-11: the earlier title said Remcos RAT and the description called any such child a strong indicator of the Remcos technique, but the selection is any winlogon.exe child with an AppData image path that is not on a three-name filter list; the title and description now say that. level goes from critical to high, because critical is reserved for never-false-positive logic and this is a path-and-parent test with a short exclusion list. False Positives: Unlikely. A winlogon.exe child with an AppData image path is not part of normal logon, and the three filtered names (userinit.exe, LogonUI.exe, dwm.exe) are excluded, but the filter is a list of three names and not an inventory of everything winlogon.exe starts, so a legitimate child outside the list that runs from AppData would match. Blind Spots: A future OS update introducing a new legitimate winlogon.exe child not in the filter list could false-positive until the filter is updated. Validation: Trigger the malware’s Userinit-hijack persistence — the AppData-sourced child of winlogon.exe must match; the three known-legitimate children (userinit.exe, LogonUI.exe, dwm.exe) must NOT fire. Deployment: Endpoint EDR / Sysmon-fed SIEM (process-creation telemetry).

title: winlogon.exe Child Process Running From an AppData Path (Userinit Hijack Pattern)
id: 78fef00f-cd92-4dcd-8413-c3ed49b56aab
status: experimental
description: >-
  Detects a child process of winlogon.exe whose image path contains \AppData\,
  other than userinit.exe, LogonUI.exe and dwm.exe. The report records Remcos
  RAT launching its AppData copy through a hijacked Winlogon Userinit value,
  but the rule has no Remcos-specific test: it matches any AppData-sourced
  winlogon.exe child that is not on the three-name filter list
references:
    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/
author: The Hunters Ledger
date: '2026-02-04'
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1547.004
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\winlogon.exe'
        Image|contains: '\AppData\'
    filter_legitimate:
        Image|endswith:
            - '\userinit.exe'
            - '\LogonUI.exe'
            - '\dwm.exe'
    condition: selection and not filter_legitimate
falsepositives:
    - Unlikely
level: high

Hunting Rules

Remcos RAT Execution from Default AppData Install Path

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1036 (Masquerading) Confidence: MODERATE Rationale: Retiered from the original file, which titled and described this rule as “Mutex Detection” and claimed the mutex Remcos_Mutex_Inj as a “definitive indicator” — but the actual detection: logic only ever matched an Image path substring. Standard Sysmon/EDR process telemetry has no field for mutex creation, so this rule cannot detect the mutex at all; scored on the logic actually implemented (a path match), not the title. The install folder name is configurable in the Remcos builder, making this a brittle, single-literal indicator. False Positives: Any software that happens to install into a folder literally named remcos (coincidental collision); brittle by design — operators can trivially rename this folder via the Remcos builder, evading this indicator entirely on the next build. Deployment: Endpoint EDR / Sysmon-fed SIEM (process-creation telemetry); broader sweep, not for auto-block.

title: Remcos RAT Execution from Default AppData Install Path
id: 412f0f16-665a-4623-9e3c-92d98012f77b
status: experimental
description: >-
  Detects process execution from the default Remcos RAT install folder
  (AppData\Roaming\remcos\). This is a path-based indicator, not a
  mutex check - the malware's mutex Remcos_Mutex_Inj cannot be detected
  via standard Sysmon/EDR process telemetry, only via YARA memory
  scanning or EDR-native mutex enumeration. The install folder name is
  configurable in the Remcos builder, so this indicator is brittle
  against operator customization.
references:
    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/
author: The Hunters Ledger
date: '2026-02-04'
tags:
    - attack.stealth
    - attack.t1036
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains: '\AppData\Roaming\remcos\'
    condition: selection
falsepositives:
    - >-
      Any software that happens to install into a folder literally
      named "remcos" (coincidental collision)
    - >-
      Brittle by design - operators can trivially rename this folder
      via the Remcos builder, evading this indicator entirely on the
      next build
level: medium

Suspicious Process Access from AppData to Browser or Explorer Process

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1055 (Process Injection) Confidence: MODERATE Rationale: A real, technique-level process-access pattern (full-access rights from a user-writable location into a browser or explorer.exe), but the %AppData% source scope is common to a large amount of legitimate consumer software, and the target/access-rights combination is not Remcos-specific. Demoted from high given the acknowledged FP scenarios below. Logic fix 2026-10-11: the access list also held 0x1000 (PROCESS_QUERY_LIMITED_INFORMATION, a read-only right that browsers and shell tooling request routinely), which contradicted the “broad or write-capable” description and added no injection signal; it is removed, leaving the two full-access masks 0x1F0FFF and 0x1FFFFF. False Positives: Legitimate software updates from AppData; development/debugging tools; software that opens a full-access handle to explorer.exe or a browser for automation or accessibility. Deployment: Endpoint EDR / Sysmon-fed SIEM (process-access telemetry); broader sweep, not for auto-block.

title: Suspicious Process Access from AppData to Browser or Explorer Process
id: 320eaf61-97be-4fc8-bee0-cab1d45aba05
status: experimental
description: >-
  Detects a process running from a user-writable %AppData% location
  opening a handle with broad or write-capable access rights to
  explorer.exe or a major browser process - a generic
  process-injection telemetry pattern observed in the Remcos RAT
  process-injection module used against this campaign, but not
  anchored to any Remcos-specific string. The %AppData% source
  location is common to a large amount of legitimate consumer
  software.
references:
    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/
author: The Hunters Ledger
date: '2026-02-04'
tags:
    - attack.stealth
    - attack.privilege-escalation
    - attack.t1055
    - detection.emerging-threats
logsource:
    category: process_access
    product: windows
detection:
    selection_source:
        SourceImage|contains: '\AppData\'
    selection_target:
        TargetImage|endswith:
            - '\explorer.exe'
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
    selection_access:
        GrantedAccess:
            - '0x1F0FFF'
            - '0x1FFFFF'
    condition: all of selection_*
falsepositives:
    - Legitimate software updates from AppData
    - Development/debugging tools
level: medium

Non-Browser Process Accessing Chrome or Firefox Credential Store Files

Tier: Hunting Robustness: 3 ATT&CK Coverage: T1555.003 (Web Browsers), T1539 (Steal Web Session Cookie) Confidence: MODERATE Rationale: Round 2 fixes 2026-10-11: the Chrome tests were contains, so Cookies Backup-style names such as ...\Default\CookiesBackup or a longer name under that path matched; they are now endswith, like the Firefox branch, so the file name is exact. The title no longer names Remcos, since nothing in the selection is Remcos-specific. A durable, family-agnostic technique detector (accessing Chrome/Firefox credential and cookie files from a non-browser process is a genuine chokepoint), but the campaign’s own false-positive list names specific, common categories of legitimate software — password managers and backup tools — that are expected to trigger it. Demoted from high to reflect that acknowledged, non-trivial FP volume; the underlying technique detection itself remains high-confidence. False Positives: Password managers (1Password, Bitwarden, LastPass) importing saved browser credentials; backup software performing full user-profile backups. Deployment: Endpoint EDR with file-read telemetry, or Windows object-access auditing (Security EID 4663) with SACLs on the browser profile files; stock Sysmon does not log file reads. Broader sweep, not for auto-block.

title: Non-Browser Process Accessing Chrome or Firefox Credential Store Files
id: 27e252f6-c5d9-4545-ab96-b180ab116a88
status: experimental
description: >-
  Detects access to Chrome (default profile Login Data and Cookies) or
  Firefox (logins.json and cookies.sqlite under a Profiles folder)
  credential and cookie database files by a process other than chrome.exe,
  firefox.exe or msedge.exe - the technique used by the Remcos RAT
  credential-theft module in this campaign. This is a family-agnostic
  technique detector with no Remcos-specific test; legitimate password
  managers and backup software are known to trigger it, so it is tiered for
  hunting rather than direct alerting.
references:
    - https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/
author: The Hunters Ledger
date: '2026-02-04'
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - detection.emerging-threats
logsource:
    category: file_access
    product: windows
    definition: 'Requires file read-access telemetry for the browser profile files, for example Security EID 4663 with an audit SACL on them or an EDR file-access sensor; stock Sysmon does not log file reads.'
detection:
    selection_chrome:
        TargetFilename|endswith:
            - '\Google\Chrome\User Data\Default\Login Data'
            - '\Google\Chrome\User Data\Default\Cookies'
    selection_firefox:
        TargetFilename|contains: '\Mozilla\Firefox\Profiles\'
        TargetFilename|endswith:
            - '\logins.json'
            - '\cookies.sqlite'
    filter_legitimate:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
    condition: (selection_chrome or selection_firefox) and not filter_legitimate
falsepositives:
    - Password managers (1Password, Bitwarden, LastPass) importing saved browser credentials
    - Backup software performing full user-profile backups
level: medium

Suricata Signatures

None of the four originally-published network signatures clear the Detection or Hunting bar as standalone rules. Two bidirectional IP-match signatures and one GET-for-.exe signature keyed solely on the campaign IP 203.159.90.147 (all three already carried in the IOC feed as atomics. See Coverage Gaps); the fourth, an HTTP-POST-plus-PNG-magic-byte signature with no host/URI/User-Agent scope, was cut as ubiquitous benign-traffic noise. Full detail on each retirement is in Coverage Gaps below.

Coverage Gaps

Cut: Remcos VB6 Dropper Detection (YARA). The original rule’s strings were entirely generic VB6-runtime and COM API names (MSVBVM60.DLL, rtcCreateObject2, DllFunctionCall, rtcShell, Scripting.FileSystemObject) plus a single generic dropped-filename (0.dll). Every one of these is standard to any VB6-compiled program, malicious or legitimate, and a goodware scan would flag heavily on MSVBVM60.DLL alone. No Remcos-specific or even malware-specific string was present; the rule’s own title and description (“obfuscated strings and anti-analysis”) did not match its actual string content, and no obfuscation/anti-analysis indicator was ever declared. Salvage was attempted (requiring all six strings simultaneously) but even that tightened form adds no distinguishing signal beyond “VB6 program that shells out and touches files,” which describes a large amount of legitimate legacy VB6 software. What would enable a rule: a distinctive embedded resource name, class name, PDB path, or an actual obfuscation/anti-analysis string from the dropper. None were captured in the original evidence.

Cut: Remcos HTTP Screenshot Exfiltration (Suricata). The rule matched an HTTP POST containing the PNG file signature (89 50 4E 47) anywhere in the first 4 bytes of the client body, with no host, URI, or User-Agent constraint ($EXTERNAL_NET any, unscoped). The PNG magic byte is the standard signature for every PNG file in existence; this pattern matches an enormous volume of entirely legitimate HTTP POST traffic (image-sharing tools, ticketing-system attachments, chat apps, cloud-storage sync, any web app accepting PNG uploads) with no pivot value. An analyst cannot meaningfully triage “every PNG upload on the network.” What would enable a rule: a distinguishing URI path, Host header, User-Agent, or encoding marker specific to the exfiltration channel. None was captured in the original evidence.

Atomics routed to the IOC feed (already present, no feed edit required):

• Sigma Remcos Network C2 Communication to 203.159.90.147. Keyed solely on DestinationIp: 203.159.90.147; removing the literal leaves nothing. The IP is already recorded in /ioc-feeds/remcos-opendirectory-campaign.json (network.indicator: 203.159.90.147, confidence DEFINITE, severity CRITICAL).
• Suricata Remcos C2 IP Block (two signatures, sid 1000001/1000002). A bidirectional pure-IP match (alert ip $HOME_NET any -> 203.159.90.147 any / the reverse direction) with no content or protocol anchor at all. The textbook IOC-feed case, not a signature.
• Suricata Remcos OpenDirectory Malware Download (sid 1000006). Combined a generic GET ... .exe URI pattern with the campaign IP as the sole discriminator; removing the IP would make this fire on virtually any software download over plain HTTP. Both malware-download URLs (hxxp://203[.]159[.]90[.]147/Payload.exe, hxxp://203[.]159[.]90[.]147/Backdoor.exe) are already recorded in the feed’s network indicators.

Retired: duplicate SIEM/EDR queries superseded by the Sigma rules above. The original file included four Splunk SPL queries, four Microsoft Sentinel/Defender KQL queries, and three PowerShell hunting scripts targeting the same techniques already covered by the Sigma rules in this file. Per the project’s third-party-intelligence-provider standard, organization-specific SIEM query syntax and interactive PowerShell response scripts are not carried forward into a published, vendor-neutral detection file. Disposition of each:

• SPL “Remcos File Presence” (FileCreate at the install path) and KQL “Remcos Mutex Detection” (also path-based, not mutex, despite its title), duplicate the retiered “Remcos RAT Execution from Default AppData Install Path” Sigma rule; retired.
• SPL “UAC Disable Command”, a looser wildcard subset of the “UAC Bypass via EnableLUA” process-creation Sigma rule; retired.
• SPL “Userinit Registry Modification” and KQL “Userinit Hijack Detection”, functionally identical to the “Winlogon Userinit Persistence” Sigma rule; retired.
• SPL “Process Injection Sequence”, a subset of the “Suspicious Process Access from AppData” Sigma rule (missing its GrantedAccess refinement); retired.
• KQL “UAC Bypass Detection” (registry-state view, DeviceRegistryEvents), genuinely complementary (catches the technique regardless of which process performs the write); reformatted into the new “EnableLUA Registry Value Set to Disable User Account Control” Sigma rule above rather than retired.
• KQL “Remcos Network Connections”, duplicate pure-IP atomic, already covered by the IOC feed; retired.
• PowerShell scripts “Hunt for Remcos Mutex,” “Hunt for UAC Disabled,” and “Hunt for Userinit Hijack”, interactive, organization-specific incident-response scripts rather than detection content; each technique they check is already covered by a Sigma rule above. Retired.
• Cisco ASA / iptables / Windows Firewall block-rule syntax for 203.159.90.147, vendor-specific configuration syntax, not detection content, and duplicative of the IP already carried in the IOC feed with a block recommendation. Retired.

Mutex-based detection has no standard SIEM/EDR log-based equivalent. Remcos_Mutex_Inj is the strongest single indicator in this campaign, but standard Sysmon/EDR process telemetry does not log mutex creation. This is why the original “mutex detection” Sigma rule (and the analogous KQL query) never actually implemented mutex matching despite their titles, and why the mutex’s Detection-tier coverage in this file is carried entirely by the YARA rules (file/memory scanning) rather than a Sigma rule. What would enable a Sigma rule: EDR-native mutex-enumeration telemetry (where the EDR platform exposes named-object creation as a loggable event), which standard Sysmon does not provide.

License

Detection rules are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Free to use, including commercially, with attribution to The Hunters Ledger.

@misc{hunters-ledger-remcos-opendirectory-detections,
  author       = {Harrison, Joseph},
  title        = {Detection Rules — Remcos RAT OpenDirectory Campaign},
  howpublished = {The Hunter's Ledger},
  year         = {2026},
  month        = {feb},
  url          = {https://the-hunters-ledger.com/hunting-detections/remcos-opendirectory-detections/},
  note         = {Published 4 February 2026. Licensed CC BY 4.0.}
}