Windows Registry: Disable Windows Security Center notifications via UseActionCenterExperience

title: "Windows Registry: Disable Windows Security Center notifications via UseActionCenterExperience"
id: f084a755-138c-415a-935e-bc8c8921da4e
status: test
description: This rule flags a registry value change that sets UseActionCenterExperience to 0 under Windows\CurrentVersion\ImmersiveShell\, which disables Windows Security Center notification behavior. Attackers can use this to reduce user visibility into security-related alerts and degrade defensive awareness. The detection relies on registry set telemetry capturing the TargetObject path and the DWORD value being written.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications.yml
author: frack113, Huntrule Team
date: 2022-08-19
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: Windows\CurrentVersion\ImmersiveShell\UseActionCenterExperience
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications/info.yml
simulation:
  - type: atomic-red-team
    name: Disable Windows Security Center Notifications
    technique: T1112
    atomic_guid: 45914594-8df6-4ea9-b3cc-7eb9321a807e
license: DRL-1.1
related:
  - id: 3ae1a046-f7db-439d-b7ce-b8b366b81fa6
    type: derived