Windows Recall Feature Enabled via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•1•0•20

Detects the enabling of the Windows Recall feature by manipulating registry keys using `reg.exe`. This rule specifically looks for commands that either delete the `DisableAIDataAnalysis` registry value or set it to `0` within the `Microsoft\Windows\WindowsAI` path, indicating an attempt to activate the Recall feature. This activity is often associated with post-exploitation discovery and collection by adversaries.