LCRYX Ransomware UAC Disable and Admin Tool Lockdown via Registry

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects modifications to Windows Registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or Command Prompt. These modifications are commonly performed by scripts (wscript.exe, cscript.exe) used by malware or malicious actors to restrict user access to system administration and diagnostic tools.