Settra Ransomware: WinRE Disabled via reagentc /disable
Detects the execution of REAgentC.exe with the /disable command-line argument. This utility is used to manage the Windows Recovery Environment (WinRE). Adversaries often disable WinRE to prevent system recovery and impede incident response, often as a prelude to data destruction or ransomware attacks.
CQL
