PowerShell Downloading Malicious Images from Remcos RAT Campaign Domains
Detects a PowerShell process initiating a network connection to download an image or text file from domains associated with a Remcos RAT campaign. In this campaign, PowerShell is used to download a steganographic image containing the next stage payload.
Microsoft Sentinel (KQL)
