Windows Set Private Network Profile via Registry

This analytic detects attempts to modify the Windows Registry to change a network profile's category to "Private". This modification, specifically setting the 'Category' value to '1' within the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID}' registry path, typically enables less restrictive firewall policies. Adversaries may perform this action to facilitate lateral movement or reduce security restrictions. While legitimate network configuration can involve this change, its occurrence outside standard IT processes or correlated with other suspicious activities (like unusual account activity, administrative privilege usage, or execution of unsigned binaries) can indicate malicious post-exploitation behavior.