Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
RAT

Remcos

RAT 101 detections found

Also known as: Remcos RAT, RemcosRAT, Remvio, Socmer

Remcos ("Remote Control and Surveillance") is a closed-source RAT commercially marketed by the vendor Breaking Security as a legitimate remote-administration tool, but it is overwhelmingly abused in criminal and espionage-adjacent phishing campaigns. It typically arrives via malicious email attachments (often weaponized Office documents or archive exploits) and gives operators keylogging, screen/webcam capture, and full remote control. CISA named Remcos one of the top malware strains observed in 2021, and it continues to be actively delivered in phishing waves as of 2025-2026.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Detection rules

Source Rule Status Updated
elastic Potential REMCOS Trojan Execution production 2026-09-18
splunk Regsvr32 Silent and Install Param Dll Loading production 2026-06-09
splunk Remcos RAT File Creation in Remcos Folder production 2026-05-13
splunk Suspicious Image Creation In Appdata Folder production 2026-05-13
splunk Suspicious WAV file in Appdata Folder production 2026-05-13
splunk Cisco Secure Firewall - Intrusion Events by Threat Activity production 2026-05-13
splunk Remcos client registry install entry production 2026-05-13
splunk Possible Browser Pass View Parameter production 2026-05-13
snort ET RETIRED [ANY.RUN] Remcos RAT Checkin 861 rev 2 2025-04-17
suricata ET RETIRED [ANY.RUN] Remcos RAT Checkin 861 rev 2 2025-04-17
snort ET TROJAN HTTP Request to Remcos Payload M2 rev 1 2024-11-06
suricata ET MALWARE HTTP Request to Remcos Payload M1 rev 1 2024-11-06
snort ET TROJAN HTTP Request to Remcos Payload M1 rev 1 2024-11-06
suricata ET MALWARE HTTP Request to Remcos Payload M2 rev 1 2024-11-06
suricata ET MALWARE Remcos Builder License Check rev 3 2024-03-25
suricata ET JA3 Hash - Remcos 3.x/4.x TLS Connection rev 1 2023-10-19
snort ET TROJAN Win32/Remcos RAT Checkin 809 rev 1 2022-07-01
suricata ET MALWARE Win32/Remcos RAT Checkin 809 rev 1 2022-07-01
suricata ET MALWARE Win32/Remcos RAT Checkin 810 rev 1 2022-07-01
snort ET TROJAN Win32/Remcos RAT Checkin 810 rev 1 2022-07-01
suricata ET MALWARE [PTsecurity] Win32/Remcos RAT Checkin 51 rev 2 2022-04-18
snort ET TROJAN [PTsecurity] Win32/Remcos RAT Checkin 51 rev 2 2022-04-18
suricata ET MALWARE Win32/Remcos RAT Checkin 781 rev 1 2022-03-11
snort ET TROJAN Win32/Remcos RAT Checkin 781 rev 2 2022-03-11
snort ET TROJAN Win32/Remcos RAT Checkin 756 rev 2 2021-10-05
suricata ET MALWARE Win32/Remcos RAT Checkin 756 rev 1 2021-10-05
snort ET TROJAN Remcos Builder License Check rev 2 2021-04-19
snort ET TROJAN Remcos 3.x Unencrypted Checkin rev 2 2021-04-16
snort ET TROJAN Remcos 3.x Unencrypted Server Response rev 2 2021-04-16
suricata ET MALWARE Remcos 3.x Unencrypted Checkin rev 2 2021-04-16
suricata ET MALWARE Remcos 3.x Unencrypted Server Response rev 2 2021-04-16
snort ET TROJAN Win32/Remcos RAT Checkin 62 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 59 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 26 rev 3 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 68 rev 2 2020-11-06
snort ET TROJAN [eSentire] Remcos RAT Checkin 25 rev 2 2020-11-06
suricata ET MALWARE Remcos RAT Checkin 23 rev 4 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 28 rev 3 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 109 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 26 rev 3 2020-11-06
suricata ET MALWARE [eSentire] Remcos RAT Checkin 24 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 27 rev 3 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 55 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 56 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 30 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 58 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 29 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 60 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 59 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 66 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 61 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 54 rev 2 2020-11-06
suricata ET MALWARE [eSentire] Remcos RAT Checkin 25 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 57 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 63 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 30 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 64 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 61 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 55 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 60 rev 2 2020-11-06
snort ET TROJAN Remcos RAT Checkin 23 rev 4 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 84 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 67 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 66 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 27 rev 3 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 57 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 56 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 63 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 65 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 109 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 28 rev 3 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 58 rev 2 2020-11-06
snort ET TROJAN [eSentire] Remcos RAT Checkin 24 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 54 rev 2 2020-11-06
snort ET TROJAN Win32/Remcos RAT Checkin 29 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 84 rev 3 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 67 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 68 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 62 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 65 rev 2 2020-11-06
suricata ET MALWARE Win32/Remcos RAT Checkin 64 rev 2 2020-11-06
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 70 rev 1 2019-07-26
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 86 rev 2 2019-07-26
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 26 rev 1 2019-07-26
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 85 rev 2 2019-07-26
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 73 rev 1 2019-07-26
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 87 rev 1 2019-07-26
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 69 rev 1 2019-07-26
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 72 rev 1 2019-07-26
suricata ET MALWARE [PTsecurity] Remcos RAT Checkin 71 rev 1 2019-07-26
snort ET TROJAN [PTsecurity] Remcos RAT Checkin 87 rev 1 2019-01-30
snort ET TROJAN [PTsecurity] Remcos RAT Checkin 85 rev 2 2019-01-24
snort ET TROJAN [PTsecurity] Remcos RAT Checkin 86 rev 2 2019-01-24
snort ET TROJAN [PTsecurity] Remcos RAT Checkin 73 rev 1 2018-10-16
snort ET TROJAN [PTsecurity] Remcos RAT Checkin 71 rev 1 2018-10-16
snort ET TROJAN [PTsecurity] Remcos RAT Checkin 70 rev 1 2018-10-16
snort ET TROJAN [PTsecurity] Remcos RAT Checkin 72 rev 1 2018-10-16
snort ET TROJAN [PTsecurity] Remcos RAT Checkin 69 rev 1 2018-10-16
snort ET TROJAN [PTsecurity] Remcos RAT Checkin 26 rev 1 2018-08-21
yara Remcos — —
yara Quasar — —