Disable PUA Protection on Windows Defender

calendar Aug 17, 2023 · attack.defense_evasion attack.t1562.001  ·
Share on: linkedin copy

Detects disabling Windows Defender PUA protection

Sigma rule (View on GitHub)

 1title: Disable PUA Protection on Windows Defender
 2id: 8ffc5407-52e3-478f-9596-0a7371eafe13
 3status: experimental
 4description: Detects disabling Windows Defender PUA protection
 5references:
 6    - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html
 7author: Austin Songer @austinsonger
 8date: 2021/08/04
 9modified: 2023/08/17
10tags:
11    - attack.defense_evasion
12    - attack.t1562.001
13logsource:
14    category: registry_set
15    product: windows
16detection:
17    selection:
18        TargetObject|contains: '\Policies\Microsoft\Windows Defender\PUAProtection'
19        Details: 'DWORD (0x00000000)'
20    condition: selection
21falsepositives:
22    - Unknown
23level: high

References

  • How to Enable or Disable Microsoft Defender Antivirus Potential Unwanted App (PUA) Protection in Windows 10 Starting with Windows 10 version 2004, Windows Defender Antivirus as been renamed to Micr...


    Read More

Related rules

to-top