Pay2Key Ransom Note Written to HKLM Policies legalnoticetext Registry Key

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects modifications to the Windows registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System where the 'legalnoticetext' value is set to contain 'pay2key'. This technique is used by the Pay2Key ransomware to display a ransom note as a system-wide legal notice during user logon.