LCRYX Ransomware Registry Policy Manipulation Disabling Task Manager and UAC

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects modifications to Windows registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or suppressing UAC prompts, when performed by scripting engines like wscript.exe or cscript.exe. This activity is often associated with malware or adversarial post-exploitation efforts to impair defensive capabilities and maintain persistence.