Remcos RAT Registry or File Modification

[rule]
description = """
Identifies registry and file system activity consistent with the Remcos Remote Access Trojan (RAT). Remcos RAT is used
by attackers to perform actions on infected machines remotely.
"""
id = "9769d372-4115-4ef8-8d7b-aaad05dad9ae"
license = "Elastic License v2"
name = "Remcos RAT Registry or File Modification"
os_list = ["windows"]
reference = [
    "https://any.run/malware-trends/remcos",
    "https://attack.mitre.org/software/S0332/",
    "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set",
]
version = "1.0.31"

query = '''
any where event.category in ("registry", "file") and
  (
    registry.path : (
      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Remcos",
      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Remcos-*\\licence",
      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Remcos-*\\exepath",
      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Remcos",
      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\Remcos-*\\licence",
      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\Remcos-*\\exepath"
      ) or
    file.path : "?:\\Users\\*\\AppData\\Roaming\\remcos\\logs.dat"
   )
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"