Kyber Ransomware BCDedit Recovery Modification
Detects the execution of bcdedit.exe to disable the Windows Recovery Environment or ignore boot failures. This is a common pre-encryption technique used by Kyber ransomware to prevent defenders from restoring the OS.
Microsoft Sentinel (KQL)
