Remcos RAT PEB Masquerade as explorer.exe for UAC Bypass
Detects potential execution of Remcos Remote Access Trojan (RAT) components or process masquerading activity involving 'explorer.exe'. The rule identifies suspicious file paths (e.g., ProgramData\Remcos\) and instances where processes named 'explorer.exe' execute from non-standard Windows directories, indicating an attempt to hide malicious activity or masquerade as a legitimate Windows system process.
Splunk (SPL)
