Remcos RAT via CVE-2017-0199 Office Process Spawning mshta or PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects suspicious child processes spawned by Microsoft Office applications (Word, Excel, WordPad, Outlook) which are characteristic of exploitation attempts, such as CVE-2017-0199. The rule monitors for execution of command-line tools (mshta, powershell, cmd, wscript, cscript) known to be used by malicious macro-enabled documents or exploit documents to download and execute secondary payloads.