is this legit? NgcFirst\ConsecutiveSwitchCount

[migs_k 0]

after logging in using PIN after a restart and 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{D6886603-9D2F-4EB2-B667-1971041FA96B}\S-1-5-21-229674073-691441657-888200982-1001\NgcFirst\ConsecutiveSwitchCount

Quote

Time;Application;Operation;Target;Action;Rule;Additional information
4/14/2021 8:44:57 PM;C:\Windows\System32\svchost.exe;Modify startup settings;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{D6886603-9D2F-4EB2-B667-1971041FA96B}\S-1-5-21-229674073-691441657-888200982-1001\NgcFirst\ConsecutiveSwitchCount;allowed;Automatic mode;

 

this came up on ESET HIPS, never seen this popping up before.

after doing some internet search, this came up

https://forum.eset.com/topic/23588-hips-alert-for-host-process/?_fromLogin=1

 

Edited April 14, 2021 by migs_k

[itman 1,362]

20 minutes ago, migs_k said:

after doing some internet search, this came up

https://forum.eset.com/topic/23588-hips-alert-for-host-process/?_fromLogin=1

This thread ended with the issue being related to Eset LiveGrid connectivity. Check your Eset Event log for any entries realted to this status.

[Marcos 4,188]

You have this setting probably enabled, it's disabled by default:

You can either disable it or disregard the notification.