Settra Ransomware Chained LOLBin Execution (reagentc/diskpart/ipconfig/cipher)
Detects a suspicious sequence of system utility executions (reagentc.exe, diskpart.exe, ipconfig.exe, and cipher.exe) originating from a single parent process within a 10-minute window. This behavior is indicative of ransomware attempting to inhibit system recovery and perform anti-forensic actions.
YARA-L
