Windows Defender PUA Protection Registry Activity
Detects processes modifying or querying Windows Defender registry keys related to Potentially Unwanted Application (PUA) protection (PUAProtection, MpEnablePus). This behavior is observed in the SessionGate malware to verify its execution environment and evade detection before deploying further payloads.
Sigma
