Remcos RAT Run Key Persistence via Hidden PowerShell Script in Temp Directory
Detects the steganographic loader campaign setting HKCU Run key persistence using powershell.exe with -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File pointing to an obfuscated .ps1 script in AppData\Local\Temp, as observed in the FortiBleed/TuglaInsaatci campaign delivering Remcos RAT.
Microsoft Sentinel (KQL)
