Skip to content
Threat Feed
Subscribe

Actor

Azorult

4 briefs RSS
medium threat

Windows Registry Modification to Suppress Defender Notifications

Adversaries, including those using Azorult malware, modify the 'Notification_Suppress' registry key to disable Windows Defender alerts and facilitate stealthy persistence.

Windows Azorult defense-evasion registry
1r 1t
medium threat

Tampering with Windows Security Center Notifications

Adversaries, including the Azorult malware group, modify registry keys to disable Windows Security Center notifications as a defense evasion tactic to suppress system alerts.

Windows Azorult defense-evasion registry-modification
1r 1t
medium threat

Windows Registry Modification to Disable Toast Notifications

Adversaries, including operators of the Azorult malware, modify the Windows Registry to disable toast notifications, preventing users from receiving critical system security updates.

Windows Azorult registry defense-evasion malware
1r 1t
high threat

Detect PowerShell AppLocker Policy Import Activity

Detection of PowerShell commands to import AppLocker policy via Import-Module Applocker and Set-AppLockerPolicy, potentially used to enforce restrictive policies or disable security products like antivirus.

Splunk Enterprise +2 Azorult applocker powershell defense-evasion endpoint
2r 1t