Windows Defender Automatic Sample Submission Disabled
Detects when the 'Automatic Sample Submission' feature of Windows Defender is disabled. This is indicated by a change in the antimalware platform configuration, specifically setting the 'SubmitSamplesConsent' registry value to '0x0'. Adversaries may disable this feature to prevent security products from submitting malicious samples for analysis, thereby hindering detection and analysis efforts.
Sigma
