LCRYX Ransomware MBR Overwrite and Boot Recovery Destruction via PowerShell

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects the execution of PowerShell or Command Prompt initiated by Windows script interpreters (wscript.exe, cscript.exe) that contain command-line arguments indicative of malicious activity. This includes commands related to raw disk access, system recovery inhibition (e.g., shadow copy or backup catalog deletion), and boot configuration manipulation often associated with ransomware or wiper activity.