Remcos RAT Multi-Key Persistence via Registry Run Keys from Suspicious Paths
Detects Remcos RAT establishing persistence by writing to Windows Registry Run keys from processes executing out of AppData, Temp, or ProgramData directories. The rule specifically looks for registry modifications in Run or RunOnce keys where the image path or the value details point to suspicious, writable directories commonly abused by malware.
Sigma
