This technique is commonly observed in the deployment of Azorult malware, where attackers aim to minimize the visible footprint of their malicious operations. By disabling these notifications, the threat actor can maintain persistence and execute follow-on malicious activities without immediate detection by the user. Defenders should monitor registry modifications targeting this specific path as a high-fidelity indicator of potential defense evasion.

Attack Chain

1. The attacker gains initial access to the target endpoint, typically through phishing or exploitation of vulnerable software.
2. The attacker executes a malicious payload, such as the Azorult malware, to establish a foothold on the system.
3. The malware checks for the presence of Windows Defender and its associated security configurations.
4. The attacker performs a registry write operation to 'HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\Notification_Suppress'.
5. The 'Notification_Suppress' registry value is set to '0x00000001' to disable security alerts.
6. The threat actor proceeds to deploy additional malicious modules or exfiltrate sensitive data from the system.
7. The attacker maintains long-term persistence, confident that the suppressed notifications will mask ongoing malicious behavior from the user.

Impact

Successful suppression of Windows Defender notifications significantly reduces the visibility of malicious activity on compromised hosts. This technique allows threat actors to evade detection, conduct data exfiltration, and establish persistence, increasing the risk of full system compromise within the targeted environment.

Recommendation

• Monitor registry modifications targeting the 'Notification_Suppress' registry value via Sysmon Event ID 13.
• Deploy the provided Sigma rule to identify unauthorized attempts to disable Windows Defender notifications.
• Establish an allowlist for legitimate administrative tools that may perform these registry modifications for maintenance purposes.
• Investigate endpoints where this registry modification occurs to determine the responsible process and confirm if it originates from an authorized management tool.

Attack Chain

1. Initial malware execution on the host system (e.g., Azorult dropper).
2. The process identifies the need to suppress user notifications to maintain stealth.
3. The malware checks for administrative privileges required to modify HKLM registry hives.
4. The malware executes a registry write operation to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell\UseActionCenterExperience.
5. The registry value is explicitly set to 0x00000000 to disable the Action Center experience.
6. The system suppresses subsequent security notifications and warnings.
7. The attacker proceeds with post-exploitation objectives, such as exfiltrating data or deploying additional payloads.

Impact

Successful suppression of security notifications allows malicious actors to maintain persistence and execute follow-on operations undetected. While specific victim counts are not provided, this technique is a recognized component of various malware campaigns, including Azorult, which primarily targets credentials and sensitive system information.

Recommendation

1. Deploy the Sigma rule provided in this brief to detect unauthorized modifications to the identified registry path.
2. Configure Sysmon Event ID 13 to log registry modifications and ensure that HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell is included in your monitoring scope.
3. Correlate alerts from this registry modification with other endpoint process creation events (Event ID 1) to identify the parent process responsible for the registry change.
4. Establish a baseline of authorized configuration management tools (e.g., SCCM, GPO) that legitimately modify this registry key to minimize false positives from administrative activity.