Windows Registry Key Deletion by Non-Critical Process

This analytic detects the deletion of registry keys by processes that are not typically associated with critical system or program files. This activity is significant as it may indicate malware, such as the Double Zero wiper, attempting to evade defenses or cause destructive payload impacts. If confirmed malicious, this behavior could lead to significant system damage, loss of critical configurations, and potential disruption of services.