Pay2Key Ransom Note Written to LegalNoticeText Registry Value

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule monitors for specific registry modifications to the Windows LegalNoticeText key, which is a known behavior of Pay2Key ransomware to display ransom notes to the user upon logon.