System Recovery Disabling via Registry
Detects registry modifications designed to disable automatic system reboots and scheduled maintenance, preventing the system from interrupting destructive actions, as observed with BLUERABBIT.
Microsoft Sentinel (KQL)
