Remcos RAT DisableUAC via reg.exe Setting EnableLUA to 0
This rule detects the use of 'reg.exe' to disable User Account Control (UAC) by setting the 'EnableLUA' registry key to '0'. This action is a common technique used by malware, such as the Remcos RAT, or by adversaries attempting to persist with elevated privileges by weakening Windows security controls.
Splunk (SPL)
