Pay2Key Ransomware Disables Shutdown via shutdownwithoutlogon Registry Key
Detects the creation or modification of the 'shutdownwithoutlogon' registry value to '0' within the Windows System Policies registry key. This registry value controls whether the shutdown option is displayed on the logon screen; setting it to 0 disables this option, which can be an indicator of an adversary attempting to restrict system access or configure the environment for a specific post-compromise state.
SentinelOne
