LCRYX Ransomware Disabling Defender Firewall and AV via PowerShell and cmd

Ibrahim Saud@tektrix

•updated Jun 25, 2026•4•0•6

Detects attempts by LCRYX ransomware to disable security protections, including Windows Defender real-time monitoring and firewall, as well as third-party antivirus software (Bitdefender, Kaspersky). The detection monitors process creation events for malicious command-line arguments, excluding legitimate administrative processes like msiexec.exe or services.exe.