Windows Defender detects shellcode in Registry hive

I've been analyzing a Virus Alert from Windows Defender, and my investigation thus far has lead me to "probably a false positive".

According to Defender, it found shellcode inside the Windows registry hive at C:\\Windows\\System32\\config\\SOFTWARE.

Malware Name: Exploit:Win32/ShellCode.gen!J

Defender classifies this as "Severe".

I'm not a shellcode or RE expert, but what would be the use of a bad actor "hiding" shellcode in this registry file? My limited understanding of how shellcode works is it requires an execution environment. Shellcode …

cybersecurity defender hive registry shellcode windows windows defender