Remcos RAT Persistence via Registry Run Keys
Detects modifications to Windows Registry Run keys that are indicative of Remcos RAT establishing persistence. The rule monitors for registry values being set or keys created in standard Run and Policy-based startup locations, specifically flagging entries that reference suspicious file paths (such as AppData or Temp) or contain known Remcos-related strings.
Microsoft Sentinel (KQL)
