{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/azorult/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Azorult"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","registry","windows","azorult"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eAdversaries frequently employ techniques to neutralize security monitoring on infected endpoints. A notable method involves modifying the Windows registry key located at 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\Notification_Suppress'. By setting this value to '0x00000001', attackers successfully suppress Windows Defender notifications, preventing users from receiving critical security alerts regarding malicious activity.\u003c/p\u003e\n\u003cp\u003eThis technique is commonly observed in the deployment of Azorult malware, where attackers aim to minimize the visible footprint of their malicious operations. By disabling these notifications, the threat actor can maintain persistence and execute follow-on malicious activities without immediate detection by the user. Defenders should monitor registry modifications targeting this specific path as a high-fidelity indicator of potential defense evasion.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to the target endpoint, typically through phishing or exploitation of vulnerable software.\u003c/li\u003e\n\u003cli\u003eThe attacker executes a malicious payload, such as the Azorult malware, to establish a foothold on the system.\u003c/li\u003e\n\u003cli\u003eThe malware checks for the presence of Windows Defender and its associated security configurations.\u003c/li\u003e\n\u003cli\u003eThe attacker performs a registry write operation to 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\Notification_Suppress'.\u003c/li\u003e\n\u003cli\u003eThe 'Notification_Suppress' registry value is set to '0x00000001' to disable security alerts.\u003c/li\u003e\n\u003cli\u003eThe threat actor proceeds to deploy additional malicious modules or exfiltrate sensitive data from the system.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains long-term persistence, confident that the suppressed notifications will mask ongoing malicious behavior from the user.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful suppression of Windows Defender notifications significantly reduces the visibility of malicious activity on compromised hosts. This technique allows threat actors to evade detection, conduct data exfiltration, and establish persistence, increasing the risk of full system compromise within the targeted environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor registry modifications targeting the 'Notification_Suppress' registry value via Sysmon Event ID 13.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to identify unauthorized attempts to disable Windows Defender notifications.\u003c/li\u003e\n\u003cli\u003eEstablish an allowlist for legitimate administrative tools that may perform these registry modifications for maintenance purposes.\u003c/li\u003e\n\u003cli\u003eInvestigate endpoints where this registry modification occurs to determine the responsible process and confirm if it originates from an authorized management tool.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:13:41Z","date_published":"2026-10-12T18:13:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-defender-notification-suppression/","summary":"Adversaries, including those using Azorult malware, modify the 'Notification_Suppress' registry key to disable Windows Defender alerts and facilitate stealthy persistence.","title":"Windows Registry Modification to Suppress Defender Notifications","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-defender-notification-suppression/"},{"_cs_actors":["Azorult"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","registry-modification","windows","azorult"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eAdversaries and malware variants, notably Azorult, employ registry modification techniques to disable Windows Security Center notifications. By targeting the 'UseActionCenterExperience' registry key and setting its value to 0, attackers suppress critical security warnings and update notifications that would otherwise alert the user to malicious activity or missing security patches. This defense evasion tactic increases the likelihood of long-term persistence, as attackers can operate with a reduced risk of being interrupted by system-level security prompts. Defenders should monitor for unauthorized modifications to the Windows ImmersiveShell registry hive, which is frequently targeted to weaken host-based defenses.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial malware execution on the host system (e.g., Azorult dropper).\u003c/li\u003e\n\u003cli\u003eThe process identifies the need to suppress user notifications to maintain stealth.\u003c/li\u003e\n\u003cli\u003eThe malware checks for administrative privileges required to modify HKLM registry hives.\u003c/li\u003e\n\u003cli\u003eThe malware executes a registry write operation to \u003ccode\u003eHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe registry value is explicitly set to \u003ccode\u003e0x00000000\u003c/code\u003e to disable the Action Center experience.\u003c/li\u003e\n\u003cli\u003eThe system suppresses subsequent security notifications and warnings.\u003c/li\u003e\n\u003cli\u003eThe attacker proceeds with post-exploitation objectives, such as exfiltrating data or deploying additional payloads.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful suppression of security notifications allows malicious actors to maintain persistence and execute follow-on operations undetected. While specific victim counts are not provided, this technique is a recognized component of various malware campaigns, including Azorult, which primarily targets credentials and sensitive system information.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to detect unauthorized modifications to the identified registry path.\u003c/li\u003e\n\u003cli\u003eConfigure Sysmon Event ID 13 to log registry modifications and ensure that HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ImmersiveShell is included in your monitoring scope.\u003c/li\u003e\n\u003cli\u003eCorrelate alerts from this registry modification with other endpoint process creation events (Event ID 1) to identify the parent process responsible for the registry change.\u003c/li\u003e\n\u003cli\u003eEstablish a baseline of authorized configuration management tools (e.g., SCCM, GPO) that legitimately modify this registry key to minimize false positives from administrative activity.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T18:11:22Z","date_published":"2026-10-12T18:11:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-security-center-tampering/","summary":"Adversaries, including the Azorult malware group, modify registry keys to disable Windows Security Center notifications as a defense evasion tactic to suppress system alerts.","title":"Tampering with Windows Security Center Notifications","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-security-center-tampering/"}],"language":"en","title":"CraftedSignal Threat Feed - Azorult","version":"https://jsonfeed.org/version/1.1"}