{"id":"1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e","title":"PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'","description":"Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9').\nThis is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level.\nAn attacker might use this technique via the command line to bypass defenses before executing payloads.\n","author":"Matt Anderson (Huntress)","status":"experimental","level":"high","date":"2025-07-11","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Highly unlikely"],"references":["https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference","https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction","https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952","https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2","https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/"],"source_path":"rules/windows/process_creation/proc_creation_win_defender_default_action_modified.yml","source_sha256":"a385387705b005acecb7d55edb5dab8c300c81c7f51c403e7c1b47e1114de056","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_defender_default_action_modified.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'\nid: 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e\nrelated:\n    - id: 5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f\n      type: similar\nstatus: experimental\ndescription: |\n    Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9').\n    This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level.\n    An attacker might use this technique via the command line to bypass defenses before executing payloads.\nreferences:\n    - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference\n    - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction\n    - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952\n    - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\nauthor: 'Matt Anderson (Huntress)'\ndate: 2025-07-11\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cmdlet:\n        CommandLine|contains: 'Set-MpPreference'\n    selection_action:\n        CommandLine|contains:\n            - '-LowThreatDefaultAction'\n            - '-ModerateThreatDefaultAction'\n            - '-HighThreatDefaultAction'\n            - '-SevereThreatDefaultAction'\n            - '-ltdefac '\n            - '-mtdefac '\n            - '-htdefac '\n            - '-stdefac '\n    selection_value:\n        CommandLine|contains:\n            - 'Allow'\n            - '6'\n            - 'NoAction'\n            - '9'\n    condition: all of selection_*\nfalsepositives:\n    - Highly unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e.json","kind":"sigma"}