Remcos RAT Runtime State Written to HKCU\SOFTWARE\{MUTEX} Registry Key
Detects suspicious Registry value modifications under HKEY_CURRENT_USER\SOFTWARE by processes like svchost.exe or iexplore.exe, involving specific keys associated with configuration (exepath, WD, FR, licence). This behavior is indicative of potential malware persistence or configuration manipulation.
Splunk (SPL)
