Query: write Sigma for Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or
Matching passage: Sigma rule: Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or. Logsource: windows / registry_event. Rule: title: Windows Defender Threat Severity Default Action Modified id: 5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f related: - id: 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e type: similar status: experimental description: 'Detects modifications or creations of Windows Defender''s default threat action settings based on severity to ''allow'' or take ''no action''. This is a highly suspicious configuration change that effectively disables Defender''s ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads. ' references: - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952 - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ author: Matt Anderson (Huntress) date: 2025-07-11 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction\ TargetObject|endswith: - \1 - \2 - \4 - \5 Details: - DWORD (0x00000006) - DWORD (0x00000009) condition: selection falsepositives: - Legitimate administration via scripts or tools (e.g., SCCM, Intune, GPO enforcement). Correlate with administrative activity. - Software installations that legitimately modify Defender settings (less common for these specific keys). level: high
Near-miss passage: Sigma rule: Detects possible command execution by web application/web shell. Logsource: linux / auditd. Rule: title: Webshell Remote Command Execution id: c0d3734d-330f-4a03-aae2-65dacc6a8222 status: test description: Detects possible command execution by web application/web shell references: - Personal Experience of the Author - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/ author: Ilyas Ochkov, Beyu Denis, oscd.community date: 2019-10-12 modified: 2025-12-05 tags: - attack.persistence - attack.t1505.003 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www -a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www -a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 ' detection: selection: type: SYSCALL SYSCALL: - execve - execveat euid: 33 condition: selection falsepositives: - Admin activity - Crazy web applications level: critical