Windows Security Center Notification Suppression via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

Detects when the 'Notification_Suppress' registry value is set to 1 under 'SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration'. This action disables Windows Security Center notifications, which can be used by adversaries for defense evasion to prevent users from being alerted to security issues.