Windows Defender Windefend AMSI Detection (Event ID 1116)
Flags Windows Defender AMSI detections via windefend Event ID 1116 with SourceName set to AMSI.
- Product
- windows
- Service
- windefend
- Author
- Bhabesh Raj (SigmaHQ), DRL 1.1
- Published
- 2020-09-14
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Defender AMSI-triggered detections where the antimalware platform (AMSI) reports malware or potentially unwanted software via Event ID 1116. Such detections matter because AMSI is commonly used to identify malicious script or content during execution attempts. The rule relies on windefend telemetry carrying the EventID value and the AMSI SourceName.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Defender Windefend AMSI Detection (Event ID 1116)
id: 1ca382cc-3c25-4abc-a99c-4b7a3d4a35f3
status: stable
description: This rule flags Windows Defender AMSI-triggered detections where the antimalware platform (AMSI) reports malware or potentially unwanted software via Event ID 1116. Such detections matter because AMSI is commonly used to identify malicious script or content during execution attempts. The rule relies on windefend telemetry carrying the EventID value and the AMSI SourceName.
references:
- https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_malware_detected_amsi_source.yml
author: Bhabesh Raj, Huntrule Team
date: 2020-09-14
modified: 2022-12-07
tags:
- attack.execution
- attack.t1059
logsource:
product: windows
service: windefend
detection:
selection:
EventID: 1116
SourceName: AMSI
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: ea9bf0fa-edec-4fb8-8b78-b119f2528186
type: derived