Microsoft-Antimalware-Service
124 events across 1 channel
Event ID 1 —
Fields #
| Name | Description |
|---|---|
Description UnicodeString | — |
Event ID 2 —
Event ID 4 —
Event ID 5 —
Event ID 6 —
Event ID 7 —
Event ID 8 —
Event ID 9 —
Event ID 10 —
Event ID 11 —
Event ID 12 —
Event ID 13 —
Event ID 14 —
Event ID 15 —
Event ID 16 —
Event ID 17 —
Fields #
| Name | Description |
|---|---|
Description UnicodeString | — |
Event ID 18 —
Fields #
| Name | Description |
|---|---|
Description UnicodeString | — |
Event ID 19 —
Fields #
| Name | Description |
|---|---|
Description UnicodeString | — |
Event ID 20 —
Fields #
| Name | Description |
|---|---|
File_ID UInt64 | — |
USN UInt64 | — |
Event ID 21 —
Fields #
| Name | Description |
|---|---|
File_ID UInt64 | — |
USN UInt64 | — |
Event ID 22 —
Fields #
| Name | Description |
|---|---|
File_ID UInt64 | — |
USN UInt64 | — |
Event ID 23 —
Fields #
| Name | Description |
|---|---|
File_ID UInt64 | — |
USN UInt64 | — |
Event ID 24 —
Event ID 25 —
Event ID 26 —
Event ID 27 —
Event ID 28 —
Fields #
| Name | Description |
|---|---|
ServiceVersion UnicodeString | — |
OsIsFreshInstall Boolean | — |
Event ID 29 —
Event ID 30 —
Event ID 31 —
Fields #
| Name | Description |
|---|---|
TrustedUSN UInt64 | — |
TrustedState UInt64 | — |
SFCState UInt64 | — |
Event ID 32 —
Event ID 33 —
Event ID 34 —
Event ID 35 —
Event ID 36 —
Event ID 37 —
Event ID 38 —
Event ID 39 —
Fields #
| Name | Description |
|---|---|
Bytes UInt32 | — |
Event ID 40 —
Event ID 41 —
Event ID 42 —
Event ID 43 —
Event ID 44 —
Fields #
| Name | Description |
|---|---|
Command UnicodeString | — |
Event ID 45 —
Event ID 46 —
Event ID 47 —
Event ID 48 —
Fields #
| Name | Description |
|---|---|
Sha1 UnicodeString | — |
Sha256 UnicodeString | — |
MD5 UnicodeString | — |
ProcessID UInt32 | — |
ProcessCreationTime UInt64 | — |
ProcessPath UnicodeString | — |
ThreatName UnicodeString | — |
RealPath UnicodeString | — |
WasExecutingWhileDetected Boolean | — |
Action UInt32 | — |
RemediationErrorCode HexInt32 | — |
DetectionTime UInt64 | — |
User UnicodeString | — |
UserSid UnicodeString | — |
ResourceSchema UnicodeString | — |
DetectionGuid UnicodeString | — |
Classification HexInt32 | — |
SchemaParamAndDataDelimiter UnicodeString | — |
SchemaParamList UnicodeString | — |
SchemaParamDataList UnicodeString | — |
DetectionSource HexInt32 | — |
IsPassiveMode Boolean | — |
SigSeq HexInt64 | — |
SigSha UnicodeString | — |
isCritical Boolean | — |
ThreatTrackingId UnicodeString | — |
PlatformVersion UnicodeString | — |
PlatformUpdateTime UInt64 | — |
EngineVersion UnicodeString | — |
EngineUpdateTime UInt64 | — |
ASSignatureVersion UnicodeString | — |
ASSignatureUpdateTime UInt64 | — |
AVSignatureVersion UnicodeString | — |
AVSignatureUpdateTime UInt64 | — |
BlockThreatExecSubCategory UInt32 | — |
PropertyBag UnicodeString | — |
AllowThreatExpirationUTC UInt64 | — |
Event ID 49 —
Fields #
| Name | Description |
|---|---|
RuleId UnicodeString | — |
isAudit Boolean | — |
Sha1 UnicodeString | — |
Sha256 UnicodeString | — |
MD5 UnicodeString | — |
FileSize UInt64 | — |
ProcessID UInt32 | — |
ProcessCreationTime UInt64 | — |
ProcessIntegrityLevel UInt32 | — |
ProcessPath UnicodeString | — |
TargetPath UnicodeString | — |
SigSeq UInt64 | — |
SigSha UnicodeString | — |
CommandLine UnicodeString | — |
DetectionTime UInt64 | — |
TargetIdentified Boolean | — |
ParentCommandLine UnicodeString | — |
InvolvedFile UnicodeString | — |
InheritanceFlags UInt32 | — |
RuleType UInt32 | — |
RuleState UInt32 | — |
SessionId UInt32 | — |
UserName UnicodeString | — |
Event ID 50 —
Fields #
| Name | Description |
|---|---|
IsAudit Boolean | — |
Uri UnicodeString | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
UserSid UnicodeString | — |
ResponseCategory UnicodeString | — |
IsWarn Boolean | — |
DisplayName UnicodeString | — |
IocId UnicodeString | — |
Event ID 51 —
Fields #
| Name | Description |
|---|---|
LocalIpAddressLength UInt32 | — |
LocalIpAddress Binary | — |
RemoteIpAddressLength UInt32 | — |
RemoteIpAddress Binary | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
UserSid UnicodeString | — |
ProcessName UnicodeString | — |
Uri UnicodeString | — |
RequestHeaders UnicodeString | — |
ResponseHeaders UnicodeString | — |
ConnectionType UnicodeString | — |
Event ID 52 —
Fields #
| Name | Description |
|---|---|
RuleId UnicodeString | — |
State UInt32 | — |
EventTimestamp UInt64 | — |
Action UnicodeString | — |
Process UnicodeString | — |
ProcessId UInt32 | — |
Source UnicodeString | — |
Target UnicodeString | — |
SessionId UInt32 | — |
Event ID 53 —
Fields #
| Name | Description |
|---|---|
UniqueId UInt64 | — |
TotalSourceFiles UInt32 | — |
CurrentIndexOfSourceFile UInt32 | — |
PolicyVersion UnicodeString | — |
PolicyRuleId UnicodeString | — |
EnforcementLevel UInt32 | — |
IsActionBypass Boolean | — |
EventTimestamp UInt64 | — |
ActionType UnicodeString | — |
Process UnicodeString | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
Source UnicodeString | — |
Target UnicodeString | — |
SessionId UInt32 | — |
UserSid SID | — |
Event ID 54 —
Fields #
| Name | Description |
|---|---|
StatusCode UInt32 | — |
StatusDetails UnicodeString | — |
Event ID 55 —
Fields #
| Name | Description |
|---|---|
Allow Boolean | — |
UserOverrideKey UnicodeString | — |
FriendlyName UnicodeString | — |
Uri UnicodeString | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
UserSid UnicodeString | — |
ResponseCategory UnicodeString | — |
IocId UnicodeString | — |
Event ID 56 —
Fields #
| Name | Description |
|---|---|
RuleId UnicodeString | — |
RuleState UInt32 | — |
SessionId UInt32 | — |
TargetIdentified Boolean | — |
Parent UnicodeString | — |
Target UnicodeString | — |
InvolvedFile UnicodeString | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
Event ID 57 —
Fields #
| Name | Description |
|---|---|
DnsServerAddressLength UInt32 | — |
DnsServerIpAddress Binary | — |
QueryName UnicodeString | — |
QueryType UInt32 | — |
ClassType UInt32 | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
UserSid UnicodeString | — |
ProcessName UnicodeString | — |
Event ID 58 —
Fields #
| Name | Description |
|---|---|
DnsServerAddressLength UInt32 | — |
DnsServerIpAddress Binary | — |
AnswerName UnicodeString | — |
Ttl UInt64 | — |
RecordType UnicodeString | — |
ResourceRecord UnicodeString | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
UserSid UnicodeString | — |
ProcessName UnicodeString | — |
Event ID 59 —
Fields #
| Name | Description |
|---|---|
IsIncoming Boolean | — |
SourceIpLength UInt32 | — |
SourceIp Binary | — |
DestinationIpLength UInt32 | — |
DestinationIp Binary | — |
Size UInt64 | — |
DestinationDNSName UnicodeString | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
UserSid UnicodeString | — |
ProcessName UnicodeString | — |
ConnectionType UnicodeString | — |
IsBehindProxy Boolean | — |
Event ID 60 —
Fields #
| Name | Description |
|---|---|
TS_State UInt32 | — |
TS_PreviousState UInt32 | — |
TS_StartUTC UInt64 | — |
TS_ExpirationUTC UInt64 | — |
TS_ExpirationMinutesLeft UInt32 | — |
TS_StateChangeSource UInt32 | — |
TS_StateChangeReason UInt32 | — |
TS_QuotaMinutesLeft UInt32 | — |
PlatformVersion UnicodeString | — |
EngineVersion UnicodeString | — |
Event ID 61 —
Fields #
| Name | Description |
|---|---|
TlsServerAddressLength UInt32 | — |
TlsServerIpAddress Binary | — |
TlsAlertLevel UInt8 | — |
TlsAlertDescription UInt8 | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
UserSid UnicodeString | — |
ProcessName UnicodeString | — |
Event ID 62 —
Fields #
| Name | Description |
|---|---|
Timestamp UInt64 | — |
RollbackVersion UnicodeString | — |
Event ID 63 —
Fields #
| Name | Description |
|---|---|
Description UnicodeString | — |
Event ID 64 —
Fields #
| Name | Description |
|---|---|
Description UnicodeString | — |
Event ID 65 —
Fields #
| Name | Description |
|---|---|
Description UnicodeString | — |
Event ID 66 —
Fields #
| Name | Description |
|---|---|
Description UnicodeString | — |
Event ID 67 —
Fields #
| Name | Description |
|---|---|
DetectionTime UInt64 | — |
TP_State UnicodeString | — |
TP_Scenario UnicodeString | — |
TP_ResourceType UnicodeString | — |
TP_ResourceName UnicodeString | — |
TP_ResourceOldState UnicodeString | — |
TP_ResourceNewState UnicodeString | — |
TP_IsBlocked UInt32 | — |
TP_IsUserMode UInt32 | — |
ProcessName UnicodeString | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
Event ID 68 —
Fields #
| Name | Description |
|---|---|
FullPath UnicodeString | — |
Version UInt32 | — |
FileSize UInt64 | — |
FrameworkType UnicodeString | — |
Sha256 UnicodeString | — |
JsonModelMetadata UnicodeString | — |
Event ID 69 —
Fields #
| Name | Description |
|---|---|
Version UInt32 | — |
TransportType UnicodeString | — |
ServerName UnicodeString | — |
CommandName UnicodeString | — |
CommandArgs UnicodeString | — |
UrlEndpoint UnicodeString | — |
Environment UnicodeString | — |
Headers UnicodeString | — |
Event ID 70 —
Fields #
| Name | Description |
|---|---|
ProcessName UnicodeString | — |
ProcessId UInt32 | — |
ProcessCreationTime UInt64 | — |
RegKeyName UnicodeString | — |
RegValueName UnicodeString | — |
DisruptionMode UInt64 | — |
Event ID 1000 — An antimalware scan started.
Fields #
| Name | Description |
|---|---|
Scan ID | ID number of the relevant scan. |
Scan Type | Scan type. Examples: Antivirus, Antispyware, or Antimalware |
Scan Parameters | Scan parameters. Examples: Full scan, Quick scan, or Custom scan |
Scan Resources | Resources (such as files/directories/BHO) that were scanned. |
User | Domain\User |
Event ID 1001 — An antimalware scan finished.
Fields #
| Name | Description |
|---|---|
Scan ID | ID number of the relevant scan. |
Scan Type | Scan type. Examples: Antivirus, Antispyware, or Antimalware |
Scan Parameters | Scan parameters. Examples: Full scan, Quick scan, or Custom scan |
User | Domain\User |
Scan Time | The duration of a scan. |
Event ID 1002 — An antimalware scan was stopped before it finished.
Fields #
| Name | Description |
|---|---|
Scan ID | ID number of the relevant scan. |
Scan Type | Scan type. Examples: Antivirus, Antispyware, or Antimalware |
Scan Parameters | Scan parameters. Examples: Full scan, Quick scan, or Custom scan |
User | Domain\User |
Scan Time | The duration of a scan. |
Event ID 1006 — The antimalware engine found malware or other potentially unwanted software.
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description. Examples: Any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls. Early Launch Antimalware (ELAM). This source includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC. |
Status | — NTSTATUS reference |
User | Domain\User |
Process Name | Process name (identified by PID) |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1007 — The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.
Description
Microsoft Defender Antivirus took action to protect this machine from malware or other potentially unwanted software.
Message #
Fields #
| Name | Description |
|---|---|
User | Domain\User |
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Action | Action. Examples: Clean: The resource was cleaned. Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist. User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing. |
Status | — NTSTATUS reference |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1008 — The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.
Description
Microsoft Defender Antivirus encountered an error when taking action on malware or other potentially unwanted software.
Message #
Fields #
| Name | Description |
|---|---|
User | Domain\User |
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Action | Action. Examples: Clean: The resource was cleaned. Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist. User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing. |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Status | — NTSTATUS reference |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1009 — The antimalware platform restored an item from quarantine.
Description
Microsoft Defender Antivirus restored an item from quarantine.
Message #
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
User | Domain\User |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1010 — The antimalware platform couldn't restore an item from quarantine.
Description
Microsoft Defender Antivirus encountered an error trying to restore an item from quarantine.
Message #
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
User | Domain\User |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1011 — The antimalware platform deleted an item from quarantine.
Description
Microsoft Defender Antivirus deleted an item from quarantine.
Message #
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
User | Domain\User |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1012 — The antimalware platform couldn't delete an item from quarantine.
Description
Microsoft Defender Antivirus encountered an error trying to delete an item from quarantine.
Message #
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
User | Domain\User |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1013 — The antimalware platform deleted history of malware and other potentially unwanted software.
Description
Microsoft Defender Antivirus removed history of malware and other potentially unwanted software.
Message #
Fields #
| Name | Description |
|---|---|
Time | The time when the event occurred, for example when the history is purged. This parameter isn't used in threat events so that there's no confusion regarding whether it's remediation time or infection time. For such events, we specifically call them as Action Time or Detection Time. |
User | Domain\User |
Event ID 1014 — The antimalware platform couldn't delete history of malware and other potentially unwanted software.
Description
Microsoft Defender Antivirus encountered an error trying to remove history of malware and other potentially unwanted software.
Message #
Fields #
| Name | Description |
|---|---|
Time | The time when the event occurred, for example when the history is purged. This parameter isn't used in threat events so that there's no confusion regarding whether it's remediation time or infection time. For such events, we specifically call them as Action Time or Detection Time. |
User | Domain\User |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 1015 — The antimalware platform detected suspicious behavior.
Description
Microsoft Defender Antivirus detected a suspicious behavior.
Message #
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this source protects against malicious webpage controls. Early Launch Antimalware (ELAM). This source includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
Status | — NTSTATUS reference |
User | Domain\User |
Process Name | Process name (identified by PID) |
Signature ID | Enumeration matching severity. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Fidelity Label | — |
Target File Name | Name of the file. |
Event ID 1116 — The antimalware platform detected malware or other potentially unwanted software.
Description
Microsoft Defender Antivirus detected malware or other potentially unwanted software.
Message #
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls. Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
User | Domain\User |
Process Name | Process name (identified by PID) |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1117 — The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.
Description
Microsoft Defender Antivirus took action to protect this machine from malware or other potentially unwanted software.
Message #
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this source protects against malicious webpage controls. Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
User | Domain\User |
Process Name | Process name (identified by PID) |
Action | Action. Examples: Clean: The resource was cleaned. Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist. User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing. |
Action Status | Description of other actions |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1118 — The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.
Description
Microsoft Defender Antivirus encountered a noncritical error when taking action on malware or other potentially unwanted software.
Message #
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls. Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
User | Domain\User |
Process Name | Process name (identified by PID) |
Action | Action. Examples: Clean: The resource was cleaned. Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing |
Action Status | Description of additional actions |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1119 — The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software.
Description
Microsoft Defender Antivirus encountered a critical error when taking action on malware or other potentially unwanted software.
Message #
Fields #
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls. Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
User | Domain\User |
Process Name | Process name (identified by PID) |
Action | Action. Examples: Clean: The resource was cleaned Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist. User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing. |
Action Status | Description of other actions |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1120 — Microsoft Defender Antivirus deduced the hashes for a threat resource.
Fields #
| Name | Description |
|---|---|
Current Platform Version | — |
Threat Resource Path | Path |
Hashes | — |
Event ID 1121 — Event when an attack surface reduction rule fires in block mode.
Event ID 1127 — Controlled Folder Access (CFA) blocked an untrusted process from making changes to the memory.
Description
Controlled Folder Access blocked an untrusted process from potentially modifying disk sectors.
Message #
Fields #
| Name | Description |
|---|---|
Product Name | Product Name. Examples: Microsoft Defender Antivirus |
Product Version | — |
Detection Time | Detection Time, time when CFA blocked an untrusted process |
User | Domain\User |
Path | Device name, name of the device or disk that an untrusted process accessed for modification |
Process Name | Process path, the process path name that CFA blocked from accessing the device or disk for modification |
Security Intelligence Version | — |
Engine Version | Antimalware Engine version |
Event ID 1150 — Antimalware platform health status report.
Event ID 1151 — Endpoint Protection client health report (time in UTC)
Description
Antivirus client health report.
Message #
Fields #
| Name | Description |
|---|---|
Platform Version | Current platform version |
Engine Version | Antimalware Engine version |
Network Realtime Inspection engine version | — |
Antivirus signature version | — |
Antispyware signature version | — |
Network Realtime Inspection signature version | — |
RTP state | Realtime protection state (Enabled or Disabled) |
OA state | On Access state (Enabled or Disabled) |
IOAV state | IE Downloads and Outlook Express Attachments state (Enabled or Disabled) |
BM state | Behavior Monitoring state (Enabled or Disabled) |
Antivirus signature age | Antivirus signature age (in days). Calculated as the time starting from the Security Intelligence Update (SIU) release date, to the current date. Before a signature is updated for the first time, it'll display an age of 65535 days. |
Antispyware signature age | Antispyware signature age (in days). Timestamp reflecting the Security Intelligence Update (SIU) release date (not the local installation time). Before the timestamp is updated for the first time, its value is null. |
Last quick scan age | Last quick scan age (in days) |
Last full scan age | Last full scan age (in days) |
Antivirus signature creation time | — |
Antispyware signature creation time | — |
Last quick scan start time | — |
Last quick scan end time | — |
Last quick scan source | Last quick scan source (0 = scan didn't run, 1 = user initiated, 2 = system initiated) |
Last full scan start time | — |
Last full scan end time | — |
Last full scan source | Last full scan source (0 = scan didn't run, 1 = user initiated, 2 = system initiated) |
Product status | For internal troubleshooting |
Event ID 2000 — The antimalware definitions updated successfully.
Description
Antivirus signature version was updated.
Message #
Fields #
| Name | Description |
|---|---|
Current Signature Version | — |
Previous Signature Version | — |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Update Type | Update type, either Full or Delta. |
User | Domain\User |
Current Engine Version | — |
Previous Engine Version | — |
Event ID 2001 — The security intelligence update failed.
Description
Microsoft Defender Antivirus encountered an error trying to update signatures.
Message #
Fields #
| Name | Description |
|---|---|
New security intelligence version | New version number |
Previous security intelligence version | Previous version |
Update Source | Update source. Examples: Security intelligence update folder Internal security intelligence update server Microsoft Update Server File share Microsoft Malware Protection Center (MMPC) |
Update Stage | Update stage. Examples: Search, Download, or Install |
Source Path | File share name for Universal Naming Convention (UNC), server name for Windows Server Update Services (WSUS)/Microsoft Update/ADL. |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Update Type | Update type, either Full or Delta. |
User | Domain\User |
Current Engine Version | — |
Previous Engine Version | — |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 2002 — The antimalware engine updated successfully.
Event ID 2003 — The antimalware engine update failed.
Description
Microsoft Defender Antivirus encountered an error trying to update the engine.
Message #
Fields #
| Name | Description |
|---|---|
New Engine Version | — |
Previous Engine Version | — |
Engine Type | Engine type, either antimalware engine or Network Inspection System engine. |
User | Domain\User |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 2004 — There was a problem loading antimalware definition.
Description
Microsoft Defender Antivirus encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Message #
Fields #
| Name | Description |
|---|---|
Signatures Attempted | — |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware engine version |
Event ID 2005 — The antimalware engine failed to load because the antimalware platform is out of date.
Event ID 2006 — The platform update failed.
Event ID 2007 — The platform will soon be out of date.
Event ID 2010 — The antimalware engine used the Dynamic Signature Service to get other definitions.
Description
Microsoft Defender Antivirus used Dynamic Signature Service to retrieve more signatures to help protect your machine.
Message #
Fields #
| Name | Description |
|---|---|
Current Signature Version | — |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Current Engine Version | — |
Dynamic Signature Type | Dynamic signature type. Examples: Version, Timestamp, No limit, or Duration |
Persistence Path | Path |
Dynamic Signature Version | Version number |
Dynamic Signature Compilation Timestamp | Timestamp |
Persistence Limit Type | Persistence limit type. Examples: VDM version, Timestamp, or No limit |
Persistence Limit | Persistence limit of the fastpath signature. |
Event ID 2011 — The Dynamic Signature Service deleted the out-of-date dynamic definitions.
Description
Microsoft Defender Antivirus used Dynamic Signature Service to discard obsolete signatures.
Message #
Fields #
| Name | Description |
|---|---|
Current Signature Version | — |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Current Engine Version | — |
Dynamic Signature Type | Dynamic signature type. Examples: Version, Timestamp, No limit, or Duration |
Persistence Path | Path |
Dynamic Signature Version | Version number |
Dynamic Signature Compilation Timestamp | Timestamp |
Removal Reason | — |
Persistence Limit Type | Persistence limit type. Examples: VDM version, Timestamp, or No limit |
Persistence Limit | Persistence limit of the fastpath signature. |
Event ID 2012 — The antimalware engine encountered an error when trying to use the Dynamic Signature Service.
Description
Microsoft Defender Antivirus encountered an error trying to use Dynamic Signature Service.
Message #
Fields #
| Name | Description |
|---|---|
Current Signature Version | — |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Current Engine Version | — |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Dynamic Signature Type | Dynamic signature type. Examples: Version, Timestamp, No limit, or Duration |
Persistence Path | Path |
Dynamic Signature Version | Version number |
Dynamic Signature Compilation Timestamp | Timestamp |
Persistence Limit Type | Persistence limit type. Examples: VDM version, Timestamp, or No limit |
Persistence Limit | Persistence limit of the fastpath signature. |
Event ID 2013 — The Dynamic Signature Service deleted all dynamic definitions.
Event ID 2020 — The antimalware engine downloaded a clean file.
Event ID 2021 — The antimalware engine failed to download a clean file.
Description
Microsoft Defender Antivirus encountered an error trying to download a clean file.
Message #
Fields #
| Name | Description |
|---|---|
Filename | Name of the file. |
Current Signature Version | — |
Current Engine Version | — |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 2030 — The antimalware engine was downloaded and is configured to run offline on the next system restart.
Description
Microsoft Defender Antivirus downloaded and configured offline antivirus to run on the next reboot.
Message #
Event ID 2031 — The antimalware engine was unable to download and configure an offline scan.
Event ID 2040 — Antimalware support for this operating system version will soon end.
Description
The support for your operating system expires shortly. Running Microsoft Defender Antivirus on an out of support operating system isn't an adequate solution to protect against threats.
Message #
Event ID 2041 — Antimalware support for this operating system has ended.
Description
The support for your operating system has expired. Running Microsoft Defender Antivirus on an out of support operating system isn't an adequate solution to protect against threats.
Message #
Event ID 2042 — The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware.
Description
The support for your operating system has expired. Microsoft Defender Antivirus is no longer supported on your operating system, has stopped functioning, and isn't protecting against malware threats.
Message #
Event ID 3002 — Real-time protection encountered an error and failed.
Description
Microsoft Defender Antivirus Real-Time Protection feature encountered an error and failed.
Message #
Fields #
| Name | Description |
|---|---|
Feature | Feature. Examples: On Access, Internet Explorer downloads and Microsoft Outlook Express attachments, Behavior monitoring, or Network Inspection System. |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Reason | The reason Microsoft Defender Antivirus real-time protection restarted a feature. |
Event ID 3007 — Real-time protection recovered from a failure.
Description
Microsoft Defender Antivirus Real-time Protection restarted a feature. It's recommended that you run a full system scan to detect any items that might have been missed while this agent was down.
Message #
Fields #
| Name | Description |
|---|---|
Feature | Feature. Examples: On Access, IE downloads and Outlook Express attachments, Behavior monitoring, or Network Inspection System |
Reason | The reason Microsoft Defender Antivirus real-time protection restarted a feature. |
Event ID 5000 — Real-time protection is enabled.
Description
Microsoft Defender Antivirus real-time protection scanning for malware and other potentially unwanted software was enabled.
Message #
Event ID 5001 — Real-time protection is disabled.
Description
Microsoft Defender Antivirus real-time protection scanning for malware and other potentially unwanted software was disabled.
Message #
Event ID 5004 — The real-time protection configuration changed.
Event ID 5007 — The antimalware platform configuration changed.
Event ID 5008 — The antimalware engine encountered an error and failed.
Event ID 5009 — Scanning for malware and other potentially unwanted software is enabled.
Description
Microsoft Defender Antivirus enabled scanning for malware and other potentially unwanted software.
Message #
Event ID 5010 — Scanning for malware and other potentially unwanted software is disabled.
Description
Microsoft Defender Antivirus scanning for malware and other potentially unwanted software is disabled.
Message #
Event ID 5011 — Scanning for viruses is enabled.
Description
Microsoft Defender Antivirus enabled scanning for viruses.
Message #
Event ID 5012 — Scanning for viruses is disabled.
Description
Microsoft Defender Antivirus scanning for viruses is disabled.
Message #
Event ID 5013 — Tamper protection blocked a change to Microsoft Defender Antivirus.
Description
If Tamper protection is enabled then any attempt to change any of Defender's settings is blocked. Event ID 5013 is generated and states which setting change was blocked.
Message #
Event ID 5100 — The antimalware platform expires soon.
Description
Microsoft Defender Antivirus entered a grace period and will soon expire. After expiration, this program will disable protection against viruses, spyware, and other potentially unwanted software.
Message #
Fields #
| Name | Description |
|---|---|
Expiration Reason | The reason Microsoft Defender Antivirus expires. |
Expiration Date | The date Microsoft Defender Antivirus expires. |
Event ID 5101 — The antimalware platform is expired.
Description
Microsoft Defender Antivirus grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.
Message #
Fields #
| Name | Description |
|---|---|
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |