LCRYX Ransomware AV/Firewall Disable via WScript Spawning PowerShell, sc, netsh

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•3

Detects the use of WScript or CScript (Windows scripting engines) to launch commands intended to disable or tamper with security products, including Windows Defender, system firewalls, Bitdefender, and Kaspersky antivirus solutions.