Windows Defender (windefend) Deletes Malware Detection History (Event ID 1013)

Alerts when Windows Defender deletes its malware/PUA detection history via windefend Event ID 1013.

FreeUnreviewedSigmainformationalv1

windows-defender-windefend-deletes-malware-detection-history-event-id-1013-2afe6582

title: Windows Defender (windefend) Deletes Malware Detection History (Event ID 1013)
id: 7b6ce5c4-a916-4429-b783-19a06d1b82ab
status: test
description: This rule flags Windows Defender events indicating the antimalware platform deleted its history of detected malware and potentially unwanted software. Attackers and insiders may remove this telemetry to reduce visibility into prior malicious activity or cleanup traces. The detection relies on windefend logs matching Event ID 1013.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
  - https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_history_delete.yml
author: Cian Heasley, Huntrule Team
date: 2020-08-13
modified: 2023-11-24
tags:
  - attack.defense-impairment
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 1013
  condition: selection
falsepositives:
  - Deletion of Defender malware detections history for legitimate reasons
level: informational
license: DRL-1.1
related:
  - id: 2afe6582-e149-11ea-87d0-0242ac130003
    type: derived

What it detects

This rule flags Windows Defender events indicating the antimalware platform deleted its history of detected malware and potentially unwanted software. Attackers and insiders may remove this telemetry to reduce visibility into prior malicious activity or cleanup traces. The detection relies on windefend logs matching Event ID 1013.

Known false positives

Deletion of Defender malware detections history for legitimate reasons

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.