Windows Registry Modification: Suppress Windows Security Center Notifications

title: "Windows Registry Modification: Suppress Windows Security Center Notifications"
id: 8d637ac0-a14b-40f4-94ea-f1f5e37bd333
status: test
description: This rule identifies a registry value set to suppress Windows Defender UX security notifications by writing Notification_Suppress as a DWORD value of 0x00000001 under the UX Configuration policy path. Attackers may use notification suppression to reduce user and administrator awareness of security-related activity. The detection relies on registry set telemetry indicating the target key path and the specific DWORD value being written.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_suppress_defender_notifications.yml
author: frack113, Huntrule Team
date: 2022-08-19
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration\Notification_Suppress
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0c93308a-3f1b-40a9-b649-57ea1a1c1d63
    type: derived