DRAYN Security Software Enumeration via Advanced Monitoring Agent Registry Read

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects the DRAYN malware enumerating security software by querying the registry key associated with the Advanced Monitoring Agent. This behavior is indicative of an adversary performing discovery to identify installed security tools on a compromised system.