Rule Info
Name
Registry Modifications to Disable Windows Security Center Features
Author
X__Junior
Description
Detects modifications to the Windows Registry intended to disable various Security Center features, these changes can indicate an attempt by malicious actors to evade security measures, suppress important security notifications, or establish persistence on the system by disabling critical security functionalities.
Date
2024-09-29 00:00:00
Modified
None
Id
e28b2d07-09cc-477b-b778-cb4e69ee232c
Tags
attack.persistence attack.t1547.001 detection.emerging-threats
Type
Nextron Sigma feed only (private)