Query: write Sigma for Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity d
Matching passage: Sigma rule: Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity d. Logsource: windows / process_creation. Rule: title: PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' id: 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e related: - id: 5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f type: similar status: experimental description: 'Detects the use of PowerShell to execute the ''Set-MpPreference'' cmdlet to configure Windows Defender''s threat severity default action to ''Allow'' (value ''6'') or ''NoAction'' (value ''9''). This is a highly suspicious configuration change that effectively disables Defender''s ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads. ' references: - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952 - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ author: Matt Anderson (Huntress) date: 2025-07-11 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_cmdlet: CommandLine|contains: Set-MpPreference selection_action: CommandLine|contains: - -LowThreatDefaultAction - -ModerateThreatDefaultAction - -HighThreatDefaultAction - -SevereThreatDefaultAction - '-ltdefac ' - '-mtdefac ' - '-htdefac ' - '-stdefac ' selection_value: CommandLine|contains: - Allow - '6' - NoAction - '9' condition: all of selection_* falsepositives: - Highly unlikely level: high
Near-miss passage: Sigma rule: All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -. Logsource: linux / auditd. Rule: title: Bpfdoor TCP Ports Redirect id: 70b4156e-50fc-4523-aa50-c9dddf1993fc status: test description: 'All TCP traffic on particular port from attacker is routed to different port. ex. ''/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only. ' references: - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/ - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor author: Rafal Piasecki date: 2022-08-10 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: auditd detection: cmd: type: EXECVE a0|endswith: iptables a1: -t a2: nat keywords: - --to-ports 42 - --to-ports 43 condition: cmd and keywords falsepositives: - Legitimate ports redirect level: medium