Detects RedTiger Stealer

Lunagrabber family

Matches Luna Grabber Rule For Entry

Detects behavior indicative of Luna Grabber malware

Modifies Windows Defender Real-time Protection settings

Redtiger family

UAC bypass

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Disables cmd.exe use via registry modification

Drops file in Drivers directory

Possible privilege escalation attempt