Windows Defender Threat Severity Default Action Modified

Matt Anderson (Huntress)

Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.

2025-07-11 00:00:00

None

5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f

attack.defense-evasion attack.t1562.001

Community Rule

Matt Anderson

Merge PR #5528 from @MATTANDERS0N - add rules for defense evasion

2025-07-28