Settra Ransomware Disables WinRE via reagentc /disable
Detects the execution of the Windows Recovery Environment (WinRE) management tool, reagentc.exe, with the '/disable' flag. This action disables the built-in system recovery features, which is a common tactic used by adversaries to prevent system restoration after data destruction or ransomware attacks.
Splunk (SPL)
