Write Protection for Storage Disabled via Registry Modification
Detects applications attempting to modify the Windows Registry to disable write protection for storage devices. This activity can precede ransomware attacks or other malicious data manipulation, as observed with certain threat groups.
Sigma
