Remcos RAT Run Key Persistence via C:\ProgramData\Remcos\remcos.exe
Detects modifications to Windows Registry Run keys that specify paths associated with Remcos remote access tool (RAT) binaries. This behavior is used by the malware to achieve persistence by automatically launching the malicious process upon user logon.
Splunk (SPL)
