Windows Modify Registry Disable Windows Security Center Notification
The analytic detects modifications to the Windows registry aimed at disabling Windows Security Center notifications. It monitors changes to the registry path "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" with a value of "0x00000000". This activity can indicate an attempt by adversaries or malware, such as Azorult, to evade defenses by suppressing critical update notifications, potentially leading to further exploitation and compromise of the host system.
Splunk (SPL)
