LCRYX Ransomware MBR Overwrite via PowerShell Writing Image Data to PhysicalDrive0

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects LCRYX ransomware behavior characterized by the disabling of Windows Defender real-time monitoring followed by an attempt to overwrite the Master Boot Record (MBR) on PhysicalDrive0 using PowerShell. The rule monitors for PowerShell processes spawned by wscript.exe or cscript.exe that reference disk drive objects or specific LCRYX image files, and correlates them with Defender tampering activities.