LCRYX Ransomware Disabling AV and Firewall via wscript.exe Child Processes

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects attempts by scripts (spawned via wscript.exe, cscript.exe, or powershell.exe) to disable or interfere with security products. This includes disabling Microsoft Defender via registry modifications or PowerShell commands, disabling the Windows Firewall using netsh, and terminating or stopping security software processes and services using taskkill, sc, or net.