What do Windows Defender Powershell ThreatAction enums map to?

Question

I'm looking at a default Defender configuration in Server 2016. I'm not sure how to discover what these '0' mean for the ThreatDefaultAction:

HighThreatDefaultAction                       : 0
LowThreatDefaultAction                        : 0
MAPSReporting                                 : 2
ModerateThreatDefaultAction                   : 0

I would think from the Set-MpPreference documentation that it's Quarantine, but that same bit of text references a Parameter set that starts with 'Clean', not 'Quarantine'. This explanation of ThreatIdDefaultActions doesn't even have a 0 in it's list: Add-MpPreference

Answer 1

All HighThreatDefaultAction, LowThreatDefaultAction, ModerateThreatDefaultAction, SevereThreatDefaultAction and UnknownThreatDefaultAction are properties of [ThreatAction] enum type. Their value specifies which automatic remediation action to take for a given level threat.

Zero value of any above property should be considered undefined as successfully performed Remove-MpPreference cmdlet sets their value to zero. Demonstration in the following example:

PS C:\WINDOWS\system32> Import-Module Defender

PS C:\WINDOWS\system32> Get-MpPreference | Select-Object -Property *DefaultAction


HighThreatDefaultAction     : 2
LowThreatDefaultAction      : 0
ModerateThreatDefaultAction : 0
SevereThreatDefaultAction   : 2
UnknownThreatDefaultAction  : 0


PS C:\WINDOWS\system32> Remove-MpPreference -Force -HighThreatDefaultAction

PS C:\WINDOWS\system32> Get-MpPreference | Select-Object -Property *DefaultAction


HighThreatDefaultAction     : 0
LowThreatDefaultAction      : 0
ModerateThreatDefaultAction : 0
SevereThreatDefaultAction   : 0
UnknownThreatDefaultAction  : 0

However, there is another vagueness in the Set-MpPreference documentation; for instance:

-HighThreatDefaultAction

Specifies which automatic remediation action to take for a high level threat. The acceptable values for this parameter are:

Quarantine
Remove
Ignore

but an attempt of Set-MpPreference -HighThreatDefaultAction Ignore leads to InvalidData error as the [ThreatAction] type enumeration does not contain name of Ignore:

PS > Import-Module Defender
PS > [Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.ThreatAction] |
    Get-EnumValue

Name                           Value
----                           -----
Clean                          1
Quarantine                     2
Remove                         3
Allow                          6
UserDefined                    8
NoAction                       9
Block                          10

Note the Get-EnumValue function comes from this my answer at CodeReview.

Answer 2

Definitely looks like the documentation is lacking there. If you look at the example for SignatureScheduleDay it documents the mapping a lot better, which lines up exactly as the Parameter Set lists them.

Best bet would be that they map according to the "Parameter Sets." Which also maps the same as the Syntax part of the help file:

                             0   |      1     |   2    |   3   |      4      |     5    |   6   
[-HighThreatDefaultAction {Clean | Quarantine | Remove | Allow | UserDefined | NoAction | Block}]

I checked to see if an issue for this was listed in github and didn't find one. You could definitely inquire more there: https://github.com/MicrosoftDocs/windows-powershell-docs/blob/master/docset/windows/defender/set-mppreference.md

Answer 3

Ok, got the answer from Microsoft support. 0 is the same as NULL (example of the docs here), which means to follow the default that Microsoft applies to each threat. In other words, every virus/malware/etc. has a severity and threat action (i.e. mitigation) attached. A '0' in GetMpPreference means to use that mitigation and not whatever value you might have specified here to override that universally for each severity level. Hope that helps any future travelers.