Reynolds Ransomware Process Enumeration via CreateToolhelp32Snapshot Targeting Security Software
Detects potential Reynolds ransomware activity by identifying processes that enumerate a significant number of security software processes (EDR/AV) using `CreateToolhelp32Snapshot` or similar process creation events. This behavior is often a precursor to security software termination or evasion.
Microsoft Sentinel (KQL)
