Windows Registry: Disabling Windows Defender PUA Protection via PUAProtection DWORD

title: "Windows Registry: Disabling Windows Defender PUA Protection via PUAProtection DWORD"
id: b89098ca-5005-4fa7-8b05-d80d165ea4f2
status: test
description: This rule identifies changes to the Windows Registry value Details set to DWORD (0x00000000) within the Policies\Microsoft\Windows Defender\PUAProtection path. Disabling PUA protection can reduce defenses against potentially unwanted applications, which attackers may rely on to broaden what gets allowed or missed by security controls. The detection relies on registry set telemetry that captures the targeted key path and the value data.
references:
  - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disabled_pua_protection_on_microsoft_defender.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-04
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Policies\Microsoft\Windows Defender\PUAProtection
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8ffc5407-52e3-478f-9596-0a7371eafe13
    type: derived