huntrule

Windows RemComSvc.exe Service File Creation

Flags creation of a RemCom service executable file (\RemComSvc.exe) on Windows.

FreeUnreviewedSigmamediumv1
title: Windows RemComSvc.exe Service File Creation
id: 7e973fbe-2e46-460e-a447-c3aefe6e2176
status: test
description: This rule matches file creation events where the target filename ends with \RemComSvc.exe, indicating installation or setup of a RemCom service binary. Attackers may use service-like components to achieve persistence or reliable execution. The detection relies on Windows file event telemetry that records the created target filename during filesystem activity.
references:
  - https://github.com/kavika13/RemCom/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_remcom_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-04
tags:
  - attack.execution
  - attack.t1569.002
  - attack.s0029
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \RemComSvc.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7eff1a7f-dd45-4c20-877a-f21e342a7611
    type: derived

What it detects

This rule matches file creation events where the target filename ends with \RemComSvc.exe, indicating installation or setup of a RemCom service binary. Attackers may use service-like components to achieve persistence or reliable execution. The detection relies on Windows file event telemetry that records the created target filename during filesystem activity.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.