Parent Process Checking Defender PUA Policy and Windows Edition

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•5

Detects a single parent process launching registry or PowerShell queries for both Defender PUA policy and Windows product edition within a ten-minute window. This behavior can indicate malware attempting to understand its environment and potentially evade detection or tailor its execution.