Windows Recall Feature Enabled via Registry Value Deletion

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•12

Detects the enabling of the Windows Recall feature by deleting the "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host and is subsequently enabled by an adversary.