Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Modifies firewall policy service

UAC bypass

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Deletes backup catalog

Uses wbadmin.exe to inhibit system recovery.

Disables Task Manager via registry modification

Disables one or more Microsoft Defender components

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disables use of System Restore points

Event Triggered Execution: Image File Execution Options Injection

Modifies Windows Firewall