Windows Disableantispyware Registry
The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
Windows Disableantispyware Registry Help
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the
Open in Search