The Commented Kill Chain: Why Old Ransomware Playbooks Never Die

This Huntress report details a ransomware intrusion in which attackers deployed a publicly shared script (linked Gist) that disabled Microsoft Defender, Defender for Endpoint services, WMI autologgers, scheduled tasks, and boot-time protections (ELAM) and altered Defender policies to allow threats. Huntress observed lateral movement via RDP and removal of shadow copies before preventing file encryption; the report enumerates the exact reg.exe, sc, schtasks, bcdedit, and Set-MpPreference commands used, maps them to Sigma rules, and emphasizes building behavior-based detections.