Remcos RAT Registry Run Key Persistence via Non-System Binary Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects modification of Windows Registry Run keys that are either explicitly associated with Remcos RAT or involve suspicious process-to-path combinations (non-standard paths being written to by command-line utilities). This rule monitors for indicators of persistent execution via common startup registry keys.