{"id":"5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f","title":"Windows Defender Threat Severity Default Action Modified","description":"Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'.\nThis is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level,\nallowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.\n","author":"Matt Anderson (Huntress)","status":"experimental","level":"high","date":"2025-07-11","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"registry_event","product":"windows"},"falsepositives":["Legitimate administration via scripts or tools (e.g., SCCM, Intune, GPO enforcement). Correlate with administrative activity.","Software installations that legitimately modify Defender settings (less common for these specific keys)."],"references":["https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference","https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction","https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952","https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2","https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/"],"source_path":"rules/windows/registry/registry_event/registry_event_defender_threat_action_modified.yml","source_sha256":"92ff7c86231d29fa6937c3dbb474fa3aee2fdae699d034d7e5cb3de77305c927","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_defender_threat_action_modified.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Defender Threat Severity Default Action Modified\nid: 5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f\nrelated:\n    - id: 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e\n      type: similar\nstatus: experimental\ndescription: |\n    Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'.\n    This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level,\n    allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.\nreferences:\n    - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference\n    - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction\n    - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952\n    - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\nauthor: 'Matt Anderson (Huntress)'\ndate: 2025-07-11\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: registry_event\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: '\\Microsoft\\Windows Defender\\Threats\\ThreatSeverityDefaultAction\\'\n        TargetObject|endswith:\n            - '\\1' # Low severity\n            - '\\2' # Moderate severity\n            - '\\4' # High severity\n            - '\\5' # Severe severity\n        Details:\n            - 'DWORD (0x00000006)' # Allow\n            - 'DWORD (0x00000009)' # NoAction\n    condition: selection\nfalsepositives:\n    - Legitimate administration via scripts or tools (e.g., SCCM, Intune, GPO enforcement). Correlate with administrative activity.\n    - Software installations that legitimately modify Defender settings (less common for these specific keys).\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f.json","kind":"sigma"}