Potential REMCOS Trojan Execution

  1[metadata]
  2creation_date = "2025/08/20"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies known file and registry traces of the REMCOS Remote Access Trojan, including log files, persistence values, and cleanup artifacts. Adversaries use Remcos to maintain persistent remote access to compromised hosts.
 11"""
 12from = "now-9m"
 13index = [
 14    "endgame-*",
 15    "logs-endpoint.events.registry-*",
 16    "logs-endpoint.events.file-*",
 17    "logs-m365_defender.event-*",
 18    "logs-sentinel_one_cloud_funnel.*",
 19    "logs-windows.sysmon_operational-*",
 20    "winlogbeat-*",
 21]
 22language = "eql"
 23license = "Elastic License v2"
 24name = "Potential REMCOS Trojan Execution"
 25references = [
 26  "https://any.run/malware-trends/remcos",
 27  "https://attack.mitre.org/software/S0332/",
 28  "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
 29]
 30risk_score = 73
 31rule_id = "d8b2f85a-cf1c-40fc-acf0-bb5d588a8ea6"
 32severity = "high"
 33tags = [
 34    "Domain: Endpoint",
 35    "OS: Windows",
 36    "Use Case: Threat Detection",
 37    "Tactic: Command and Control",
 38    "Resources: Investigation Guide",
 39    "Data Source: Elastic Endgame",
 40    "Data Source: Elastic Defend",
 41    "Data Source: Sysmon",
 42    "Data Source: SentinelOne",
 43    "Data Source: Microsoft Defender XDR",
 44    "Noise: Medium",
 45    "Performance: Normal",
 46    "Rule Type: Event Correlation (EQL)",
 47    "Platform: Windows",
 48]
 49timestamp_override = "event.ingested"
 50type = "eql"
 51
 52query = '''
 53any where host.os.type == "windows" and
 54(
 55 (event.category == "file" and event.type == "deletion" and file.path like "?:\\Users\\*\\AppData\\Local\\Temp\\TH????.tmp") or
 56
 57 (event.category == "file" and file.path : "?:\\Users\\*\\AppData\\Roaming\\remcos\\logs.dat") or
 58
 59 (event.category == "registry" and
 60  registry.value : ("Remcos", "Rmc-??????", "licence") and
 61  registry.path : (
 62      "*\\Windows\\CurrentVersion\\Run\\Remcos",
 63      "*\\Windows\\CurrentVersion\\Run\\Rmc-??????",
 64      "*\\SOFTWARE\\Remcos-*\\licence",
 65      "*\\Software\\Rmc-??????\\licence"
 66  )
 67 )
 68)
 69'''
 70
 71note = """## Triage and analysis
 72
 73### Investigating Potential REMCOS Trojan Execution
 74
 75#### Possible investigation steps
 76
 77- Which Remcos-related artifact family matched, and does it indicate install, persistence, or cleanup evidence?
 78  - Focus: `event.category` plus the matched `file.path`, `registry.path`, `registry.value`, `registry.data.strings`, and whether the trace's user profile or hive scope matches `user.id`.
 79  - Implication: "logs.dat" indicates active or recent keystroke/clipboard logging; a Run-key or licence registry path indicates persistence is set; a temp-file deletion indicates installer cleanup. The artifact's user profile or hive scope identifies which account is compromised.
 80
 81- Which process or user touched the Remcos trace, and does that writer fit detonation, remediation, or malware execution?
 82  - Focus: the recovered writer identity and launch context, especially `process.executable`, `process.code_signature.subject_name`, `process.parent.executable`, and `user.id`.
 83  - Hint: if the source event lacks process identity, recover the writer via `process.entity_id` or `process.pid` plus a tight time window on the same `host.id`.
 84  - Implication: if the writer is an unknown binary on a non-lab host, treat it as the Remcos payload or its installer. If the writer is a known sandbox, detonation engine, or IR cleanup tool on a designated lab host, the trace is expected.
 85
 86- What payload or persistence target do adjacent file and registry events resolve to?
 87  - Focus: file and registry events on the same `host.id`: `file.path`, `file.Ext.original.path`, `registry.path`, `registry.data.strings`, and any payload or autorun target tied to `process.entity_id`.
 88  - Implication: a surviving Run-key target, startup copy, or staged binary under `%APPDATA%` or `%TEMP%` confirms the infection has active persistence and the payload is still present. Bounded removal of those artifacts without a surviving payload indicates cleanup is underway but verify that ALL persistence mechanisms are gone, not just the ones visible in the alert.
 89
 90- Is there active outbound C2 or proxy traffic on this host?
 91  - Focus: host-scoped network events around the alert time, checking `dns.question.name`, `dns.resolved_ip`, `destination.ip`, `destination.port` for connections to rare public destinations, direct-IP egress, dynamic-DNS infrastructure, or unusual ports consistent with Remcos controller or SOCKS proxy use.
 92  - Implication: active C2 traffic confirms the infection is live and requires immediate containment; absence of C2 traffic may indicate the payload was already removed or has not yet activated. Missing network telemetry is unresolved, not benign.
 93
 94- If the local evidence stays suspicious, does this host or user show related alerts that explain precursor compromise or follow-on access?
 95  - Focus: related alerts for the same `host.id` and `user.id` in the last 48 hours to identify delivery, persistence, credential, command-and-control, or lateral-movement activity.
 96    - $investigate_0
 97    - $investigate_1
 98  - Implication: broaden when the host or user shows delivery, credential theft, or follow-on remote-access alerts after the artifact; keep the case narrower when related activity is absent or resolves to one detonation or remediation workflow.
 99
100- Escalate when the artifact, writer, persistence status, C2 activity, or alert scope align with active Remcos execution; close only when all evidence fits a recognized detonation or remediation workflow; if mixed or incomplete, preserve and escalate.
101
102### False positive analysis
103
104- Malware-analysis or detonation hosts can legitimately create Remcos traces. Confirm it when the writer identity, `host.id`, and any network activity all stay inside a known lab or sandbox environment. If lab records are unavailable, require the same writer and `host.id` to recur across prior alerts.
105- Incident-response cleanup can remove Remcos artifacts. Confirm it when the writer matches a known cleanup tool, surrounding events show bounded removal, and no new C2 or lateral-movement activity follows.
106
107### Response and remediation
108
109- If confirmed benign, reverse any temporary containment and document the confirmed writer, `host.id`, and artifact family that justified the closure. Create an exception only if that same workflow recurs consistently across prior alerts from this rule.
110- If suspicious but unconfirmed, preserve the matched `file.path` or `registry.path`, `registry.data.strings`, recovered `process.entity_id`, writer executable and parent context. Apply the least disruptive reversible containment that matches the findings, starting with outbound restrictions on confirmed destinations and using host isolation only when active command-and-control or lateral movement is still plausible for that asset. Avoid destructive cleanup until scope is clearer.
111- If confirmed malicious, use endpoint response to isolate the host after weighing host criticality and record the `process.entity_id`, command line, parent chain, and trace paths. If direct endpoint response is unavailable, escalate with that evidence set to the team that can contain the host and implicated accounts.
112- Before eradicating or reimaging, review other hosts and users for the same writer identity, artifact family, or C2 destinations so scoping is complete. For confirmed infections, consider reimaging over manual cleanup -- Remcos can establish multiple persistence mechanisms and manual eradication risks missing one. If reimaging is not feasible, eradicate all identified Remcos artifacts including Run keys, licence-related registry paths, staged binaries, "logs.dat", and linked temp artifacts, then verify no alternate persistence survives.
113- Post-incident hardening: review how the payload reached the host, restrict user-writable persistence paths where practical, and retain registry and network telemetry for Remcos-related activity.
114"""
115
116setup = """## Setup
117
118This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
119
120Setup instructions: https://ela.st/install-elastic-defend
121
122### Additional data sources
123
124This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
125
126- [Microsoft Defender XDR](https://ela.st/m365-defender)
127- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
128- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
129- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
130- [Sysmon Event ID 23 - File Delete](https://ela.st/sysmon-event-23-setup)
131"""
132
133[rule.investigation_fields]
134field_names = [
135    "@timestamp",
136    "event.category",
137    "event.type",
138    "event.action",
139    "host.name",
140    "host.id",
141    "user.name",
142    "user.id",
143    "process.name",
144    "process.executable",
145    "process.entity_id",
146    "process.pid",
147    "process.code_signature.subject_name",
148    "file.path",
149    "file.name",
150    "registry.path",
151    "registry.value",
152    "registry.data.strings",
153]
154
155[[transform.investigate]]
156label = "Alerts associated with the user"
157description = ""
158providers = [
159  [
160    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
161    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
162  ]
163]
164relativeFrom = "now-48h/h"
165relativeTo = "now"
166
167[[transform.investigate]]
168label = "Alerts associated with the host"
169description = ""
170providers = [
171  [
172    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
173    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
174  ]
175]
176relativeFrom = "now-48h/h"
177relativeTo = "now"
178
179[[rule.threat]]
180framework = "MITRE ATT&CK"
181
182[[rule.threat.technique]]
183id = "T1219"
184name = "Remote Access Tools"
185reference = "https://attack.mitre.org/techniques/T1219/"
186
187[rule.threat.tactic]
188id = "TA0011"
189name = "Command and Control"
190reference = "https://attack.mitre.org/tactics/TA0011/"
191
192[[rule.threat]]
193framework = "MITRE ATT&CK"
194
195[[rule.threat.technique]]
196id = "T1070"
197name = "Indicator Removal"
198reference = "https://attack.mitre.org/techniques/T1070/"
199
200[[rule.threat.technique.subtechnique]]
201id = "T1070.004"
202name = "File Deletion"
203reference = "https://attack.mitre.org/techniques/T1070/004/"
204
205[rule.threat.tactic]
206id = "TA0005"
207name = "Defense Evasion"
208reference = "https://attack.mitre.org/tactics/TA0005/"
209
210[[rule.threat]]
211framework = "MITRE ATT&CK"
212
213[[rule.threat.technique]]
214id = "T1547"
215name = "Boot or Logon Autostart Execution"
216reference = "https://attack.mitre.org/techniques/T1547/"
217
218[[rule.threat.technique.subtechnique]]
219id = "T1547.001"
220name = "Registry Run Keys / Startup Folder"
221reference = "https://attack.mitre.org/techniques/T1547/001/"
222
223[rule.threat.tactic]
224id = "TA0003"
225name = "Persistence"
226reference = "https://attack.mitre.org/tactics/TA0003/"