GigaWiper Registry Modification Disabling AutoReboot and Crash-Dump Recovery
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Microsoft Sentinel (KQL)
