Remcos Registry Enumeration of Installed Software and AV via reg.exe and WMIC
Detects reconnaissance activities performed by system binaries (wmic.exe, reg.exe, tasklist.exe) that are commonly used to enumerate security software, registry keys, and system configuration. Additionally, it alerts on any of these tools being spawned by processes originating from the ProgramData\Remcos directory, which is a known indicator of the Remcos Remote Access Trojan (RAT).
Cortex XDR
