Windows Defender Threat Severity Default Action Modified
Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events for Windows Registry modifications including key creation, modification, and deletion.
detection:
selection:
TargetObject|contains: '\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction\'
TargetObject|endswith:
- '\1' # Low severity
- '\2' # Moderate severity
- '\4' # High severity
- '\5' # Severe severity
Details:
- 'DWORD (0x00000006)' # Allow
- 'DWORD (0x00000009)' # NoAction
condition: selectionLegitimate administration via scripts or tools (e.g., SCCM, Intune, GPO enforcement). Correlate with administrative activity.
Software installations that legitimately modify Defender settings (less common for these specific keys).
Tactics
Sub-techniques