Salat Stealer C2 scripts disabling WinRE (reagentc) and UAC (EnableLUA=0)

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•3

Detects the execution of Salat Stealer C2-pushed scripts involving the disabling of recovery environment via reagentc.exe and UAC disabling via registry modification on the same device within one hour.