Ransomware-Related Registry Changes

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects multiple registry value set events where the registry value data contains keywords like 'ransom' or 'payment', or the registry key contains 'Run'. This behavior can indicate ransomware activity attempting to establish persistence or communicate its demands.