Disable PUA Protection on Windows Defender

Title: Disable PUA Protection on Windows Defender
Status: test
Description:Detects disabling Windows Defender PUA protection
References:
  -https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html
Author: Austin Songer @austinsonger
Date: 2021-08-04
modified:2023-08-17
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\Policies\Microsoft\Windows Defender\PUAProtection'
    Details: 'DWORD (0x00000000)'
  condition:selection
Falsepositives:
  -Unknown
Level: high