Query: rule covering Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity d
Matching passage: Sigma rule: Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity d. Logsource: windows / process_creation. Rule: title: PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' id: 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e related: - id: 5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f type: similar status: experimental description: 'Detects the use of PowerShell to execute the ''Set-MpPreference'' cmdlet to configure Windows Defender''s threat severity default action to ''Allow'' (value ''6'') or ''NoAction'' (value ''9''). This is a highly suspicious configuration change that effectively disables Defender''s ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads. ' references: - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952 - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ author: Matt Anderson (Huntress) date: 2025-07-11 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_cmdlet: CommandLine|contains: Set-MpPreference selection_action: CommandLine|contains: - -LowThreatDefaultAction - -ModerateThreatDefaultAction - -HighThreatDefaultAction - -SevereThreatDefaultAction - '-ltdefac ' - '-mtdefac ' - '-htdefac ' - '-stdefac ' selection_value: CommandLine|contains: - Allow - '6' - NoAction - '9' condition: all of selection_* falsepositives: - Highly unlikely level: high
Near-miss passage: Sigma rule: Detects a suspicious curl process start the adds a file to a web request. Logsource: linux / process_creation. Rule: title: Suspicious Curl File Upload - Linux id: 00b90cc1-17ec-402c-96ad-3a8117d7a582 related: - id: 00bca14a-df4e-4649-9054-3f2aa676bc04 type: derived status: test description: Detects a suspicious curl process start the adds a file to a web request references: - https://twitter.com/d1r4c/status/1279042657508081664 - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file - https://curl.se/docs/manpage.html - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) date: 2022-09-15 modified: 2023-05-02 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1105 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /curl selection_cli: - CommandLine|contains: - ' --form' - ' --upload-file ' - ' --data ' - ' --data-' - CommandLine|re: \s-[FTd]\s filter_optional_localhost: CommandLine|contains: - ://localhost - ://127.0.0.1 condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Scripts created by developers and admins level: medium