Suspicious Change of Windows Defender Threat Severity Default Action (via registry_event)

This rule detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly anomalous configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing hostile software to run unimpeded. An adversary might use this method to bypass defenses before running payloads.