Remcos RAT Persistence via Run Key with PowerShell Hidden Execution

Duo Tech@duotech

•updated Jun 22, 2026•0•0•3

Detects modifications to the 'Run' registry key that include suspicious command-line arguments often used by malware for persistence and evasion. Specifically looks for '-ExecutionPolicy Bypass', '-WindowStyle Hidden', or references to 'AppData\Local\Temp' in the registry data.