Remcos Loader VM/Sandbox Evasion via Registry Key Enumeration
This rule detects registry activity that indicates the presence of a virtualization or sandbox environment. Malware often checks for such environments to evade analysis. The rule specifically looks for registry keys and values associated with VMware and VirtualBox.
Cortex XDR
