Detectionhighexperimental

PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'

Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9'). This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Matt Anderson (Huntress)Created Fri Jul 111e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2ewindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_cmdlet:
        CommandLine|contains: 'Set-MpPreference'
    selection_action:
        CommandLine|contains:
            - '-LowThreatDefaultAction'
            - '-ModerateThreatDefaultAction'
            - '-HighThreatDefaultAction'
            - '-SevereThreatDefaultAction'
            - '-ltdefac '
            - '-mtdefac '
            - '-htdefac '
            - '-stdefac '
    selection_value:
        CommandLine|contains:
            - 'Allow'
            - '6'
            - 'NoAction'
            - '9'
    condition: all of selection_*

False Positives

Highly unlikely

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Sub-techniques

T1562.001 · Disable or Modify Tools

Related Rules

SimilarDetectionhigh

Windows Defender Threat Severity Default Action Modified

Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e

Status

experimental

Level

high

Type

Detection

Created

Fri Jul 11

Author

Matt Anderson (Huntress)

Path

rules/windows/process_creation/proc_creation_win_defender_default_action_modified.yml

Raw Tags

attack.defense-evasionattack.t1562.001

View on GitHub