Detecting Remcos Tool Used by FIN7 with Splunk

[sorangutan]

The following is a walkthrough of Remcos executed via Attack Range Local. We will go over some of the multiple and intrusive operations this remote access tool can execute at compromised hosts.

https://www.splunk.com/en_us/blog/security/splunk-fin7-tool-detections-remcos.html