LCRYX Ransomware Scancode Map and SwapMouseButtons Registry Sabotage

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

This rule detects modifications to specific Windows Registry keys used for keyboard layout remapping ('Scancode Map') or mouse button swapping ('SwapMouseButtons'). Such modifications can be used by adversaries to facilitate keylogging, persistent input redirection, or to impair user interaction. The rule prioritizes alerts where the change was initiated by script engines like wscript.exe or cscript.exe, which are common vectors for VBScript-based malware.