Windows windefend: Windows Defender threat detection and mitigation events
Alerts on windefend events indicating Windows Defender malware detection and potential remediation activity.
- Product
- windows
- Service
- windefend
- Author
- Ján Trenčanský (SigmaHQ), DRL 1.1
- Published
- 2020-07-28
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Defender malware detection engine and antimalware platform events indicating malware or suspicious behavior and subsequent protection actions. Such detections matter because attackers often rely on persistence and execution of malicious content, and Defender telemetry provides high-signal evidence that defensive engines observed potentially unwanted activity. It relies on windefend logs with Event IDs 1006, 1015, 1116, and 1117, which correspond to detection and remediation-related engine activity.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows windefend: Windows Defender threat detection and mitigation events"
id: e8747f96-559e-4b70-bf59-d965def8bd11
status: stable
description: This rule identifies Windows Defender malware detection engine and antimalware platform events indicating malware or suspicious behavior and subsequent protection actions. Such detections matter because attackers often rely on persistence and execution of malicious content, and Defender telemetry provides high-signal evidence that defensive engines observed potentially unwanted activity. It relies on windefend logs with Event IDs 1006, 1015, 1116, and 1117, which correspond to detection and remediation-related engine activity.
references:
- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_threat.yml
author: Ján Trenčanský, Huntrule Team
date: 2020-07-28
tags:
- attack.execution
- attack.t1059
logsource:
product: windows
service: windefend
detection:
selection:
EventID:
- 1006
- 1015
- 1116
- 1117
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 57b649ef-ff42-4fb0-8bf6-62da243a1708
type: derived