TOKYOCORE Registry Access to Uninstall Key for AV Enumeration/Fake Install Registration
Detects the TOKYOCORE ransomware processes (fsociety.exe or WindowsUpdate.exe) querying the Windows Uninstall registry key. This behavior indicates the malware is either enumerating installed security products to bypass them or attempting to register itself as an installed application.
Cortex XDR
