REMCOS RAT Registry Run Key Persistence (HKCU/HKLM/Policies\Explorer\Run)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the creation or modification of Windows Registry Run keys that contain references to the Remcos remote access trojan path in 'ProgramData'. This pattern is commonly used by the Remcos RAT to achieve persistence upon user logon.