Defender Notifications Suppressed Reg Add
Detects modifications to the Windows registry that suppress Windows Defender notifications. It monitors the Notification_Suppress value under the Windows Defender\UX Configuration key for being set to 1, which silences Defender’s security alerts to the user. Adversaries (including Azorult malware) use this defense-evasion technique to operate without alerting the victim or triggering visible security warnings. Maps to MITRE T1562.001 (Impair Defenses) and T1112 (Modify Registry).
YARA
