WinRE Disabled via reagentc /disable Command
Detects the execution of the 'reagentc.exe' utility with the '/disable' argument. This command is used to disable the Windows Recovery Environment (WinRE), which is a common post-compromise activity performed by ransomware and other malware to prevent system recovery and hinder incident response efforts.
Sigma
