Threat Intel
REMCOS RAT 2024: Persistence, UAC Bypass, and Browser Data Erasure – Detection Guidance
The REMCOS RAT, active in 2024, establishes persistence via the Run key, injects into svchost.exe and Internet Explorer, bypasses UAC with ICMLuaUtil, disables UAC, clears browser cookies, and logs keystrokes. Defenders should monitor registry modifications to EXEPath, unsigned process injections, and file deletions, and enforce UAC and signed‑binary policies.
What happened
In 2024, the REMCOS RAT spread across Windows environments, establishing persistence through the Run key, injecting into svchost.exe and Internet Explorer, and bypassing UAC with ICMLuaUtil. It also disables UAC via reg.exe, uses dynamic DNS for command‑and‑control, deletes browser cookies, and logs keystrokes through SetWindowsHookEx.
Impact
Infected machines can exfiltrate credentials, tamper with user accounts, and force credential re‑entry by clearing browser data. The malware’s persistence and privilege escalation make it hard to remove without full endpoint remediation.
Detection & Hunting
- Registry modification to the EXEPath value:
event.category:"registry" AND event.action:"modification" AND registry.value:"EXEpath" AND NOT process.code_signature.trusted:true - File deletions of INetCookies container.dat by unsigned binaries:
event.category:"file" AND event.action:"deletion" AND file.name:"container.dat" AND file.path:*INetCookies* AND NOT process.code_signature.trusted:true - Process injection into svchost.exe or iexplore.exe from unsigned parents: monitor
process.parent.name:"iexplore.exe" OR process.parent.name:"svchost.exe"withprocess.code_signature.trusted:false. - UAC bypass via ICMLuaUtil: watch for execution of
icmluautil.exeand registry writes toHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA.
Mitigation
Block execution of unsigned binaries in the system directories, enforce UAC, and disable the Run key persistence mechanism. Deploy the Elastic Security queries above and keep the endpoint agents up to date. If infection is suspected, perform a full system scan and reset affected user credentials.
Related articles
REMCOS RAT 2024: Watchdog Persistence and Offline Keylogger Mechanisms
The 2024 REMCOS RAT uses a watchdog process to maintain persistence and a low‑profile offline keylogger that writes to a predictable AppData path. Defenders should monitor for injected svchost.exe or rmclient.exe processes, check HKCU\SOFTWARE\{MUTEX}\WD registry entries, and look for keylogger.dat files in %APPDATA%. Early detection can prevent data exfiltration and process restarts.
Read briefing
ClickFix Social Engineering: Defend Against User-Pasted Command Execution
CrowdStrike published guidance on ClickFix attacks, in which victims are persuaded to copy and run malicious commands in their own shells or browsers. The technique targets employees, contractors, and any user with terminal or browser access. Defenders should treat user-initiated command execution as a high-risk indicator and combine browser controls, endpoint detection, identity monitoring, and SOC triage.
Read briefing
SilabRAT (SnappyClient) – Darkweb‑MaaS RAT Focused on Credential Theft
SilabRAT, also known as SnappyClient, is a remote‑access trojan sold as malware‑as‑a‑service on dark‑web forums. Developed by the actor “o1oo1”, it targets financial credentials and can bypass many endpoint defenses. Defenders should harden detection, block known download points, and monitor for suspicious persistence mechanisms.
Read briefing
Advanced Linux Persistence Detection: New Guidance on Init Scripts and Custom Tools
Elastic Security’s latest Linux persistence series expands beyond Systemd to cover System V and Upstart init scripts, and introduces PANIX for testing persistence. Defenders can now deploy pre‑built detection rules, audit critical init directories, and validate coverage with the new tool.
Read briefing