Windows Recall Enabled via reg.exe Registry Changes (Windows)
Flags reg.exe commands that delete or set DisableAIDataAnalysis to 0 under WindowsAI to enable Windows Recall.
- Product
- windows
- Category
- process_creation
- Author
- Sajid Nawaz Khan (SigmaHQ), DRL 1.1
- Published
- 2024-06-02
- Updated
- 2026-07-30
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies attempts to enable the Windows Recall feature by modifying the DisableAIDataAnalysis registry policy using reg.exe. It matches process creation where reg.exe is invoked with a command line containing WindowsAI/DisableAIDataAnalysis and either a delete operation or adding the value 0. Enabling Recall can support post-exploitation discovery and collection, making policy tampering a meaningful attacker behavior. The rule relies on Windows process creation telemetry with command-line fields.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/client-management/manage-recall
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_enable_windows_recall.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Recall Enabled via reg.exe Registry Changes (Windows)
id: a52628fb-ab9b-4140-a913-0f457895a5b2
related:
- id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62
type: similar
- id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4
type: similar
- id: 817f252c-5143-4dae-b418-48c3e9f63728
type: derived
status: test
description: This rule identifies attempts to enable the Windows Recall feature by modifying the DisableAIDataAnalysis registry policy using reg.exe. It matches process creation where reg.exe is invoked with a command line containing WindowsAI/DisableAIDataAnalysis and either a delete operation or adding the value 0. Enabling Recall can support post-exploitation discovery and collection, making policy tampering a meaningful attacker behavior. The rule relies on Windows process creation telemetry with command-line fields.
references:
- https://learn.microsoft.com/en-us/windows/client-management/manage-recall
- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_enable_windows_recall.yml
author: Sajid Nawaz Khan, Huntrule Team
date: 2024-06-02
tags:
- attack.collection
- attack.t1113
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe
selection_value:
CommandLine|contains|all:
- Microsoft\Windows\WindowsAI
- DisableAIDataAnalysis
selection_action_add:
CommandLine|contains:
- add
- "0"
selection_action_delete:
CommandLine|contains: delete
condition: selection_img and selection_value and 1 of selection_action_*
falsepositives:
- Legitimate use/activation of Windows Recall
level: medium
license: DRL-1.1