Windows windefend logs Windows Defender detections and remediation actions

Alerts on windefend events indicating Windows Defender malware detection and potential remediation activity.

FreeUnreviewedSigmahighv1

windows-windefend-logs-windows-defender-detections-and-remediation-actions-57b649ef

title: Windows windefend logs Windows Defender detections and remediation actions
id: e8747f96-559e-4b70-bf59-d965def8bd11
status: stable
description: This rule matches windefend events where the antimalware engine or platform detects malware or potentially unwanted software and may take protective actions. Such detections matter because attackers often rely on execution of malicious payloads, and successful detection can disrupt execution or indicate active compromise attempts. The rule relies on Windows Defender/antimalware telemetry from the windefend service, specifically event IDs 1006, 1015, 1116, and 1117.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_threat.yml
author: Ján Trenčanský, Huntrule Team
date: 2020-07-28
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID:
      - 1006
      - 1015
      - 1116
      - 1117
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 57b649ef-ff42-4fb0-8bf6-62da243a1708
    type: derived

What it detects

This rule matches windefend events where the antimalware engine or platform detects malware or potentially unwanted software and may take protective actions. Such detections matter because attackers often rely on execution of malicious payloads, and successful detection can disrupt execution or indicate active compromise attempts. The rule relies on Windows Defender/antimalware telemetry from the windefend service, specifically event IDs 1006, 1015, 1116, and 1117.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.