Windows Recovery Environment Disabled via Reagentc

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•0•18

Detects attempts to disable the Windows Recovery Environment (WinRE) using the `reagentc.exe` command-line tool with the `/disable` argument. Disabling WinRE can prevent system recovery and troubleshooting, which is a common tactic used by adversaries to hinder incident response and recovery efforts.