Windows Defender Threat Severity Default Action Modified

Matt Anderson (Huntress)

Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.

2025-07-11 00:00:00

None

5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f

attack.defense-impairment attack.t1685

Community Rule

Nasreddine Bencherchali

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29

Matt Anderson

Merge PR #5528 from @MATTANDERS0N - add rules for defense evasion

2025-07-28