huntrule

Windows Windefend Antimalware Restores File from Quarantine (Event ID 1009)

Alerts on Windows Defender Windefend events indicating an item was restored from quarantine (Event ID 1009).

FreeUnreviewedSigmahighv1
title: Windows Windefend Antimalware Restores File from Quarantine (Event ID 1009)
id: 22331656-02ba-4453-bef0-ba938445cd6b
status: test
description: This rule flags Windows Defender (Windefend) events where the antimalware platform restores an item from quarantine. Adversaries may attempt to undermine defenses by triggering or prompting restoration of malicious content to bypass quarantine controls. The detection relies on Windefend telemetry reporting Event ID 1009 for quarantine restore actions and is intended to surface both legitimate admin restores and potential security-impacting activity.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_restored_quarantine_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-06
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 1009
  condition: selection
falsepositives:
  - Legitimate administrator activity restoring a file
level: high
license: DRL-1.1
related:
  - id: bc92ca75-cd42-4d61-9a37-9d5aa259c88b
    type: derived

What it detects

This rule flags Windows Defender (Windefend) events where the antimalware platform restores an item from quarantine. Adversaries may attempt to undermine defenses by triggering or prompting restoration of malicious content to bypass quarantine controls. The detection relies on Windefend telemetry reporting Event ID 1009 for quarantine restore actions and is intended to surface both legitimate admin restores and potential security-impacting activity.

Known false positives

  • Legitimate administrator activity restoring a file

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.