Remcos RAT Registry Run Key Persistence and Watchdog Process Detection
This rule detects persistence mechanisms and process execution patterns associated with the Remcos Remote Access Trojan (RAT). It monitors Registry run key modifications pointing to known Remcos installation paths, as well as process lineage involving Remcos and its associated watchdog processes (svchost.exe, rmclient.exe, fsutil.exe).
CQL
