C2Looper WerFault Suppression via Registry Modification (Unsigned Process)
Detects C2Looper disabling Windows Error Reporting via registry modification to suppress crash dialogs, excluding common enterprise provisioning tools that legitimately configure the same keys.
Microsoft Sentinel (KQL)

