Windows Modify Registry DontShowUI
The analytic detects modifications to the Windows Error Reporting registry key "DontShowUI" to suppress error reporting dialogs. It identifies changes where the registry value is set to 0x00000001. This activity is significant as it is commonly associated with DarkGate malware, which uses this modification to avoid detection during its installation. If confirmed malicious, this behavior could allow attackers to maintain a low profile, avoiding user alerts and potentially enabling further malicious activities without user intervention.
Splunk (SPL)
