ROOTBOY PowerShell Installed Software Enumeration via Uninstall Registry Keys

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects reconnaissance activity where PowerShell is used to enumerate installed software by querying Windows registry uninstall keys (HKLM and HKCU) via cmdlets such as Get-ItemProperty, Get-StartApps, or Get-AppxPackage. This behavior is associated with the ROOTBOY/Prinz Eugen campaign, typically performed as a precursor to ransomware deployment.