Remcos RAT Delivery via CVE-2017-0199 RTF OLE Exploitation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects potential exploitation of CVE-2017-0199 where Microsoft Office applications (winword.exe or eqnedt32.exe) spawn suspicious child processes (mshta.exe, wscript.exe, cscript.exe, powershell.exe, or cmd.exe) often associated with malicious document-based payloads like Remcos RAT. The rule monitors for both process spawning patterns and command-line arguments indicative of remote payload retrieval.