WinRE Disabled via reagentc.exe /disable (Settra Ransomware)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•3

Detects the execution of the Windows Recovery Environment Configuration Tool (REAgentC.exe) with the '/disable' argument. Adversaries may use this command to inhibit system recovery, preventing users from using built-in Windows recovery options during or after a malicious event.