LCRYX Ransomware MBR Overwrite and Boot Config Destruction via PowerShell

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects instances where VBScript or JScript engines (wscript.exe, cscript.exe) spawn PowerShell or BCDedit processes. The rule specifically monitors for activities related to disk tampering (e.g., physical drive access or File I/O) and the suppression of Windows recovery features via bcdedit, which are common tactics used by ransomware and destructive malware to disable system backups and prevent remediation.