Remcos RAT Persistence via Registry Run Keys from ProgramData
Detects the Remcos RAT establishing persistence by writing its binary path (typically under %ProgramData%\Remcos\remcos.exe) to Windows registry Run keys or Explorer Run policy keys.
YARA-L
