CmdID / PowerShell / Cmdlets / Set
Set-MpPreference
Configures preferences for Windows Defender scans and updates. Windows Server PowerShell reference
From the Windows Server PowerShell reference 107 parameters 6 Sigma rules look for it Its page in the reference
Parameters
Show its 107 parameters
-AllowDatagramProcessingOnWinServer, -adpowsSpecifies whether to disable inspection of UDP connections on Windows Server.-AllowNetworkProtectionDownLevel, -anpdlSpecifies whether to allow network protection to be set to Enabled or Audit Mode on Windows versions before 1709.-AllowNetworkProtectionOnWinServer, -anpwsSpecifies whether to allow network protection to be set to Enabled or Audit Mode for Windows Server.-AllowSwitchToAsyncInspectionSpecifies whether to enable a performance optimization that allows synchronously inspected network flows to switch to async inspection once they have been checked and validated.-AsJobRuns the cmdlet as a background job.-AttackSurfaceReductionOnlyExclusionsSpecifies the files and paths to exclude from Attack Surface Reduction (ASR) rules.-AttackSurfaceReductionRules_ActionsSpecifies the states of attack surface reduction rules specified by using the AttackSurfaceReductionRules_Ids parameter.-AttackSurfaceReductionRules_IdsSpecifies the states of attack surface reduction rules specified by using the AttackSurfaceReductionRules_Ids parameter.-CheckForSignaturesBeforeRunningScan, -csbrIndicates whether to check for new virus and spyware definitions before Windows Defender runs a scan.-CimSession, -SessionRuns the cmdlet in a remote session or on a remote computer.-CloudBlockLevelSpecifies a cloud block level.-CloudExtendedTimeout, -cloudextimeoutSpecifies the amount of extended time to block a suspicious file and scan it in the cloud.-ControlledFolderAccessAllowedApplicationsSpecifies applications that can make changes in controlled folders.-ControlledFolderAccessProtectedFoldersSpecifies more folders to protect.-DisableArchiveScanning, -darchscIndicates whether to scan archive files, such as .zip and .cab files, for malicious and unwanted software.-DisableAutoExclusions, -daeIndicates whether to disable the Automatic Exclusions feature for the server.-DisableBehaviorMonitoring, -dbmIndicates whether to enable behavior monitoring.-DisableBlockAtFirstSeen, -dbafIndicates whether to enable block at first seen.-DisableCacheMaintenance, -dcmDefines whether the cache maintenance idle task will perform the cache maintenance or not.-DisableCatchupFullScan, -dcfscIndicates whether Windows Defender runs catch-up scans for scheduled full scans.-DisableCatchupQuickScan, -dcqscIndicates whether Windows Defender runs catch-up scans for scheduled quick scans.-DisableCpuThrottleOnIdleScansIndicates whether the CPU will be throttled for scheduled scans while the device is idle.-DisableDatagramProcessing, -ddtgpSpecifies whether to disable inspection of UDP connections.-DisableDnsOverTcpParsing, -ddnstcppSpecifies whether to disable inspection of DNS traffic that occurs over a TCP channel.-DisableDnsParsing, -ddnspSpecifies whether to disable inspection of DNS traffic that occurs over a UDP channel.-DisableFtpParsing, -dfpSpecifies whether to disable FTP parsing for network protection.-DisableEmailScanning, -demscIndicates whether Windows Defender parses the mailbox and mail files, according to their specific format, in order to analyze mail bodies and attachments.-DisableGradualRelease, -dgrSpecifies whether to disable gradual rollout of monthly and daily Windows Defender updates.-DisableHttpParsing, -dhttppSpecifies whether disable inspection of HTTP traffic.-DisableInboundConnectionFiltering, -dicfSpecifies whether to inspect only outbound connections.-DisableIOAVProtection, -dioavpIndicates whether Windows Defender scans all downloaded files and attachments.-DisableNetworkProtectionPerfTelemetry, -dnppThis setting disables the gathering and sending of performance telemetry from network protection.-DisablePrivacyMode, -dpmThis is a legacy setting that does not have any affect on current platforms.-DisableRdpParsing, -drdppThis setting controls whether to parse RDP traffic to look for malicious attacks using the RDP protocol.-DisableRealtimeMonitoring, -drtmIndicates whether to use real-time protection.-DisableRemovableDriveScanning, -drdscIndicates whether to scan for malicious and unwanted software in removable drives, such as flash drives, during a full scan.-DisableRestorePoint, -drp, -dsnfIndicates whether to disable scanning of restore points.-DisableScanningMappedNetworkDrivesForFullScan, -dsmndfscIndicates whether to scan mapped network drives.-DisableScanningNetworkFiles, -dsnfIndicates whether to scan for network files.-DisableScriptScanning, -dscrptscSpecifies whether to disable the scanning of scripts during malware scans.-DisableSshParsing, -dsshpSpecifies whether to disable inspection of SSH traffic.-DisableSmtpParsing, -dspThis setting disables SMTP parsing for network protection.-DisableTlsParsing, -dtlspSpecifies whether to disable inspection of TLS traffic.-EnableControlledFolderAccessSpecifies the state for the controlled folder access feature.-EnableDnsSinkhole, -ednssSpecifies whether to examine DNS traffic to detect and sinkhole DNS exfiltration attempts and other DNS based malicious attacks.-EnableFileHashComputation, -efhcSpecifies whether to enable file hash computation.-EnableFullScanOnBatteryPower, -efsobpSpecifies whether Windows Defender does a full scan while on battery power.-EnableLowCpuPriority, -elcpSpecifies whether Windows Defender uses low CPU priority for scheduled scans.-EnableNetworkProtectionSpecifies how the network protection service handles web-based malicious threats, including phishing and malware.-EngineUpdatesChannel, -erelrSpecifies when devices receive Microsoft Defender engine updates during the monthly gradual rollout.-ExclusionExtensionSpecifies an array of file name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning.-ExclusionIpAddressSpecifies an array of IP addresses to exclude from scheduled and real-time scanning.-ExclusionPathSpecifies an array of file paths to exclude from scheduled and real-time scanning.-ExclusionProcessSpecifies an array of processes, as paths to process images.-ForceForces the command to run without asking for user confirmation.-ForceUseProxyOnly, -fupoSpecifies whether to force the device to use only the proxy.-HighThreatDefaultAction, -htdefacSpecifies which automatic remediation action to take for a high level threat.-IntelTDTEnabled, -itdteThis policy setting configures the Intel TDT integration level for Intel TDT-capable devices.-LowThreatDefaultAction, -ltdefacSpecifies which automatic remediation action to take for a low level threat.-MAPSReportingSpecifies the type of membership in Microsoft Active Protection Service.-MeteredConnectionUpdates, -mcupdSpecifies whether to update managed devices to update through metered connections.-ModerateThreatDefaultAction, -mtdefacSpecifies which automatic remediation action to take for a moderate level threat.-OobeEnableRtpAndSigUpdateThis setting allows you to configure whether real-time protection and Security Intelligence Updates are enabled during Out of Box experience (OOBE).-PlatformUpdatesChannel, -prelrSpecifies when devices receive Microsoft Defender platform updates during the monthly gradual rollout.-ProxyBypass, -proxbpsSpecifies proxy bypasses.-ProxyPacUrl, -ppurlSpecifies the Privilege Attribute Certificate (PAC) proxy.-ProxyServer, -proxsrvSpecifies the proxy server.-PUAProtectionSpecifies the level of detection for potentially unwanted applications.-QuarantinePurgeItemsAfterDelay, -qpiadSpecifies the number of days to keep items in the Quarantine folder.-RandomizeScheduleTaskTimes, -rsttIndicates whether to select a random time for the scheduled start and scheduled update for definitions.-RealTimeScanDirection, -rtsdSpecifies scanning configuration for incoming and outgoing files on NTFS volumes.-RemediationScheduleDay, -rsdSpecifies the day of the week on which to perform a scheduled full scan in order to complete remediation.-RemediationScheduleTime, -rstSpecifies the time of day, as the number of minutes after midnight, to perform a scheduled scan.-ReportingAdditionalActionTimeOut, -raatSpecifies the number of minutes before a detection in the additional action state changes to the cleared state.-ReportingCriticalFailureTimeOut, -rctoSpecifies the number of minutes before a detection in the critically failed state changes to either the additional action state or the cleared state.-ReportingNonCriticalTimeOut, -rnctoSpecifies the number of minutes before a detection in the non-critically failed state changes to the cleared state.-ScanAvgCPULoadFactor, -saclfSpecifies the maximum percentage CPU usage for a scan.-ScanOnlyIfIdleEnabled, -soiieIndicates whether to start scheduled scans only when the computer is not in use.-ScanParametersSpecifies the scan type to use during a scheduled scan.-ScanPurgeItemsAfterDelay, -spiadSpecifies the number of days to keep items in the scan history folder.-ScanScheduleDay, -scsdSpecifies the day of the week on which to perform a scheduled scan.-ScanScheduleQuickScanTime, -scsqstSpecifies the time of day, as the number of minutes after midnight, to perform a daily scheduled quick scan.-ScanScheduleOffset, -scsoConfigures the number of minutes after midnight to perform a scheduled scan.-ScanScheduleTime, -scsqstSpecifies the time of day to run a scheduled scan.-SchedulerRandomizationTime, -srtSpecifies the randomization time for the scheduler.-ServiceHealthReportInterval, -shriThis policy setting configures the time interval (in minutes) for the service health reports to be sent from endpoints.-SevereThreatDefaultAction, -stdefacSpecifies which automatic remediation action to take for a severe level threat.-SharedSignaturesPath, -ssp, -SecurityIntelligenceLocation, -sslSpecifies the shared signatures path as a UNC file path to a file share containing pre-downloaded and unpackaged security intelligence updates.-SignatureAuGracePeriod, -sigagpSpecifies a grace period, in minutes, for the definition.-SignatureBlobFileSharesSources, -sigbfsSpecifies the file shares sources for signatures.-SignatureBlobUpdateInterval, -sigbuiSpecifies the signature update interval.-SignatureDefinitionUpdateFileSharesSources, -sigdufssSpecifies file-share sources for definition updates.-SignatureDisableUpdateOnStartupWithoutEngine, -sigduoswoIndicates whether to initiate definition updates even if no antimalware engine is present.-SignatureFallbackOrder, -sfoSpecifies the order in which to contact different definition update sources.-SignatureFirstAuGracePeriod, -sigfagpSpecifies a grace period, in minutes, for the definition.-SignatureScheduleDay, -sigsdSpecifies the day of the week on which to check for definition updates.-SignatureScheduleTime, -sigstSpecifies the time of day, as the number of minutes after midnight, to check for definition updates.-SignaturesUpdatesChannel, -srelrSpecifies when devices receive daily Microsoft Defender definition updates during the monthly gradual rollout.-SignatureUpdateCatchupInterval, -siguciSpecifies the number of days after which Windows Defender requires a catch-up definition update.-SignatureUpdateInterval, -siguiSpecifies the interval, in hours, at which to check for definition updates.-SubmitSamplesConsentSpecifies how Windows Defender checks for user consent for certain samples.-ThreatIDDefaultAction_Actions, -tiddefacaSpecifies an array of the actions to take for the IDs specified by using the ThreatIDDefaultAction_Ids parameter.-ThreatIDDefaultAction_Ids, -tiddefaciSpecifies an array of threat IDs.-ThrottleLimitSpecifies the maximum number of concurrent operations that can be established to run the cmdlet.-ThrottleForScheduledScanOnlyA CPU usage limit can be applied to scheduled scans only, or to scheduled and custom scans.-UILockdownIndicates whether to disable UI lockdown mode.-UnknownThreatDefaultAction, -unktdefacSpecifies which automatic remediation action to take for an unknown level threat.What looks for it
criticalMint Sandstorm - AsperaFaspex Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)
criticalMint Sandstorm - ManageEngine Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)
highPowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'Matt Anderson (Huntress)