Remcos RAT Loader Keylogger Activity

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•11

Detects process activity indicative of keylogging by the Remcos RAT loader. The rule specifically looks for processes with 'Remcos' or 'GST*.com' in their file name that also contain command-line arguments related to capturing window text or foreground window information, which are common keylogger behaviors.