Windows Defender windefend Event 1013: Malware detection history deletion
Alerts when Windows Defender deletes its malware/PUA detection history via windefend Event ID 1013.
FreeReviewedSigma · Informational · v2
- Product
- windows
- Service
- windefend
- Author
- Cian Heasley (SigmaHQ), DRL 1.1
- Published
- 2020-08-13
- Updated
- 2026-07-31
What it detects
This rule identifies Windows Defender antimalware events where the platform deletes the history of detected malware and potentially unwanted software. Attackers or administrators may trigger this to reduce forensic visibility of prior detections. The detection relies on the windefend log telemetry, specifically EventID 1013.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
- web.archive.orghttps://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_history_delete.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-defender-windefend-deletes-malware-detection-history-event-id-1013-2afe6582
title: "Windows Defender windefend Event 1013: Malware detection history deletion"
id: 7b6ce5c4-a916-4429-b783-19a06d1b82ab
status: test
description: This rule identifies Windows Defender antimalware events where the platform deletes the history of detected malware and potentially unwanted software. Attackers or administrators may trigger this to reduce forensic visibility of prior detections. The detection relies on the windefend log telemetry, specifically EventID 1013.
references:
- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
- https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_history_delete.yml
author: Cian Heasley, Huntrule Team
date: 2020-08-13
modified: 2023-11-24
tags:
- attack.defense-impairment
logsource:
product: windows
service: windefend
detection:
selection:
EventID: 1013
condition: selection
falsepositives:
- Deletion of Defender malware detections history for legitimate reasons
level: informational
license: DRL-1.1
related:
- id: 2afe6582-e149-11ea-87d0-0242ac130003
type: derived