Disable Windows Defender PUA Protection via Registry

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects attempts to disable Windows Defender's Potentially Unwanted Application (PUA) protection by monitoring changes to the 'PUAProtection' registry key. Specifically, it triggers when the 'PUAProtection' value is set to '0x00000000' (DWORD 0), indicating that PUA protection has been disabled.