Skip to main content
Registration for .conf24 is open! Join us June 11-14 in Las Vegas.
Splunk Lantern

Detecting indicators of Remcos RAT malware


Malware attacks sometimes begin with a phishing email that contains a malicious macro code or malicious URL link that downloads either the actual loader or the next stager to download the actual payload. Malware loader scripts are very flexible in terms of updates, encryption, and code obfuscation to bypass detections. The most prevalent loaders are window scripting languages, JScript (.js), and VBScript (.vbs).

Remcos, or Remote Control and Surveillance, is marketed as a legitimate software for remotely managing Windows systems. It is now widely used in malicious campaigns by threat actors. Remcos loader that utilizes DynamicWrapperX (dynwrapx.dll) to execute shellcode and inject Remcos RAT into the target process.

You need to design and deploy effective monitoring capabilities for Remcos exploitation activities, including searches that find file writes associated with its payload, screen capture, registry modification, UAC bypass, persistence, and data collection.

Data required

How to use Splunk software for this use case

To deploy this use case, make sure that you have the Splunk ES Content Updates installed on your Splunk Enterprise Security deployment. This extensive content library empowers you to deploy out-of-the-box security detections and analytic stories to enhance your investigations and improve your security posture. If you do not have Splunk Enterprise Security, these detections will still give you an idea of what you can accomplish with SPL in the Splunk platform or with the free app, Splunk Security Essentials.

Some of the detections that can help you with this use case include:

Next steps

During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.

If your results indicate an attack has occurred, the host or computer where the vulnerability is detected needs to be further investigated and remediated according to your response plan. This involves a final step of re-imaging the system with a known good system build after investigation.

In addition, these Splunk resources might help you understand and implement this use case:

Splunk OnDemand Services: Use these credit-based services for direct access to Splunk technical consultants with a variety of technical services from a pre-defined catalog. Most customers have OnDemand Services per their license support plan. Engage the ODS team at if you require assistance.