Settra Ransomware Disabling WinRE via reagentc /disable
Detects the execution of 'reagentc.exe' with the '/disable' flag, which is used to disable the Windows Recovery Environment (WinRE). Adversaries often perform this action as part of an attempt to inhibit system recovery during ransomware operations or other destructive attacks.
SentinelOne
