Sigma rule: Windows Defender Threat Severity Default Action Modified

Rule

Title

Windows Defender Threat Severity Default Action Modified

Status

experimental

Level

high

Author

Matt Anderson (Huntress)

Date

2025-07-11

File

rules/windows/registry/registry_event/registry_event_defender_threat_action_modified.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'.
This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level,
allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.

Log source

product

windows

category

registry_event

Detection

selection:
    TargetObject|contains: '\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction\'
    TargetObject|endswith:
        - '\1' # Low severity
        - '\2' # Moderate severity
        - '\4' # High severity
        - '\5' # Severe severity
    Details:
        - 'DWORD (0x00000006)' # Allow
        - 'DWORD (0x00000009)' # NoAction
condition: selection

False positives (as the rule lists them)

• Legitimate administration via scripts or tools (e.g., SCCM, Intune, GPO enforcement). Correlate with administrative activity.
• Software installations that legitimately modify Defender settings (less common for these specific keys).

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

Related rules

• 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e (similar)

References

• https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference
• https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction
• https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952
• https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2
• https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_event/registry_event_defender_threat_action_modified.yml