MSRT Update Prevention via Registry

Tim Peck@timpeck

•updated Jun 2, 2026•0•0•10

Detects the creation or modification of the 'DontOfferThroughWUAU' registry value under the Microsoft MRT policy key. This is a known defense evasion technique used by malware, such as the SilentCryptoMiner campaign, to permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from automatically updating or installing via Windows Update.