Settra Ransomware Disabling WinRE via reagentc /disable
Detects the execution of reagentc.exe with the /disable flag, which is used to disable the Windows Recovery Environment (WinRE). This activity is often performed by ransomware actors prior to data encryption to prevent system recovery and hinder incident response.
YARA-L
