Cephalus Defense Evasion And AV Impairment

Tim Peck@timpeck

•updated Nov 6, 2025•2•1•68

Detects Cephalus ransomware behavior, specifically the deletion of Volume Shadow Copies and tampering with Windows Defender settings, which are common precursor activities to encryption.