Remcos RAT Registry Enumeration of Installed Software via Uninstall Key
Detects potential malicious activity where a process enumerates installed software by querying the Windows Uninstall registry key (HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall) for application details such as DisplayName, Publisher, and UninstallString. This pattern is characteristic of Remcos RAT's 'ListInstalledApplications' capability to perform reconnaissance on a compromised host.
YARA-L
