System Restore disabled via SystemRestore Policy DisableSR/DisableConfig

Subhankar H@Andrewsec57

•updated Jul 6, 2026•0•0•4

Detects the modification of Windows Registry keys used to disable System Restore functionality, which can be an indication of an adversary attempting to inhibit system recovery.