Windows PowerShell: Set-MpPreference Low/Moderate/High/SevereThreatDefaultAction to Allow or NoAction

Alerts when PowerShell Set-MpPreference sets Defender threat-severity default actions to Allow or NoAction.

FreeUnreviewedSigmahighv1

windows-powershell-set-mppreference-low-moderate-high-severethreatdefaultaction--1e8a9b4d

title: "Windows PowerShell: Set-MpPreference Low/Moderate/High/SevereThreatDefaultAction to Allow or NoAction"
id: afd82cfa-d276-45f3-8ea2-5553b02271fc
related:
  - id: 5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f
    type: similar
  - id: 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e
    type: derived
status: experimental
description: This rule flags PowerShell process executions that run the Set-MpPreference cmdlet to change Windows Defender threat severity default actions to either Allow ("Allow"/value 6) or NoAction ("NoAction"/value 9). Disabling or weakening Defender’s default handling for specific threat severities can allow malicious activity to proceed with reduced security controls. It relies on process creation telemetry and matches on command-line content containing Set-MpPreference along with the relevant threat-severity parameter flags and chosen action values.
references:
  - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference
  - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction
  - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952
  - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_defender_default_action_modified.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2025-07-11
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmdlet:
    CommandLine|contains: Set-MpPreference
  selection_action:
    CommandLine|contains:
      - -LowThreatDefaultAction
      - -ModerateThreatDefaultAction
      - -HighThreatDefaultAction
      - -SevereThreatDefaultAction
      - "-ltdefac "
      - "-mtdefac "
      - "-htdefac "
      - "-stdefac "
  selection_value:
    CommandLine|contains:
      - Allow
      - "6"
      - NoAction
      - "9"
  condition: all of selection_*
falsepositives:
  - Highly unlikely
level: high
license: DRL-1.1

What it detects

This rule flags PowerShell process executions that run the Set-MpPreference cmdlet to change Windows Defender threat severity default actions to either Allow ("Allow"/value 6) or NoAction ("NoAction"/value 9). Disabling or weakening Defender’s default handling for specific threat severities can allow malicious activity to proceed with reduced security controls. It relies on process creation telemetry and matches on command-line content containing Set-MpPreference along with the relevant threat-severity parameter flags and chosen action values.

Known false positives

Highly unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.