detect Remcos in memory

Hunt Hypothesis

This hunt targets adversaries deploying the Remcos remote access trojan (RAT) to establish persistent, in-memory command and control channels that evade traditional disk-based scanning. Proactively hunting for this behavior in Azure Sentinel is critical because identifying these lightweight memory artifacts early allows the SOC team to isolate compromised endpoints before the RAT can exfiltrate sensitive data or pivot laterally across the network.

YARA Rule

rule Quasar {
          meta:
            description = "detect Remcos in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            hash1 = "390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724"

          strings:
            $quasarstr1 = "Client.exe" wide
            $quasarstr2 = "({0}:{1}:{2})" wide
            $class = { 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 73 00 00 17 69 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 69 00 6F 00 6E 00 00 80 }
          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “detect Remcos in memory” rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled System Health Monitoring via PowerShell

  • Context: An automated scheduled task (Task Scheduler) runs a PowerShell script (powershell.exe) that loads custom .NET assemblies to check system health. If the Remcos detection logic relies on specific memory signatures or DLL injection patterns, these legitimate scripts may mimic the behavior of the Remcos RAT’s core modules.
  • Suggested Filter/Exclusion: Create an exclusion for powershell.exe processes launched by the “SYSTEM” account where the parent process is svchost.exe (specifically the TaskScheduler service) and the command line contains keywords like -File, -NoProfile, or references to internal monitoring scripts (e.g., C:\Scripts\HealthCheck.ps1).

• Scenario: Endpoint Protection Real-Time Scanning

  • Context: Enterprise EDR agents, such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black, frequently inject their own scanning engines into the memory space of active processes to perform real-time analysis. This injection mechanism can trigger memory-based detection rules that look for foreign code execution patterns similar to Remcos’s communication modules.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is a known EDR service (e.g., C:\Program Files\CrowdStrike\fsagent.exe, MsMpEng.exe) and the detected memory module path resides within the vendor’s installation directory (e.g., paths starting with C:\ProgramData\Microsoft\Windows Defender or C:\Program Files\CrowdStrike).

• Scenario: Software Deployment via SCCM/Intune

  • Context: During a mass software deployment,