Message

Microsoft Defender Antivirus state updated to %1.

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 scan has started.
 	Scan ID: %3
 	Scan Type: %5
 	Scan Parameters: %7
 	Scan Resources: %11
  	User: %8\%9
 	Scan Trigger: %13
 	Scan Only If Idle: %14
 	Low CPU Priority for Scans: %15
 	Thread Priority: %16

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Defender
  guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78
  event_source_name: ''
  event_id: 1000
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2022-04-07T17:03:12.968279+00:00'
  event_record_id: 32
  correlation: {}
  execution:
    process_id: 2680
    thread_id: 2860
  channel: Microsoft-Windows-Windows Defender/Operational
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Product Name: Microsoft Defender Antivirus
  Product Version: 4.18.2104.5
  Scan ID: '{CE345D2C-02E3-48B3-8683-BF64336A98E7}'
  Scan Type Index: '1'
  Scan Type: Antimalware
  Scan Parameters Index: '1'
  Scan Parameters: Quick Scan
  Domain: NT AUTHORITY
  User: SYSTEM
  SID: S-1-5-18
  Scan Resources: ''
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus
• Example event sourced from https://github.com/NextronSystems/evtx-baseline
• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 scan has finished.
 	Scan ID: %3
 	Scan Type: %5
 	Scan Parameters: %7
 	User: %8\%9
 	Scan Time: %11:%12:%13

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Defender
  guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78
  event_source_name: ''
  event_id: 1001
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2022-04-04T14:09:02.003645+00:00'
  event_record_id: 102
  correlation:
    ActivityID: 5F56C890-B44B-432D-8EF6-FB4D94734C2D
  execution:
    process_id: 1796
    thread_id: 3036
  channel: Microsoft-Windows-Windows Defender/Operational
  computer: WIN-TKC15D7KHUR
  security:
    user_id: S-1-5-18
event_data:
  Product Name: Microsoft Defender Antivirus
  Product Version: 4.18.2202.4
  Scan ID: '{7749FCE9-BEE7-43EC-991B-C0ADC46B93C1}'
  Scan Type Index: '1'
  Scan Type: Antimalware
  Scan Parameters Index: '1'
  Scan Parameters: Quick Scan
  Domain: WIN-TKC15D7KHUR
  User: Administrator
  SID: S-1-5-21-1958040314-2592322477-2606035944-500
  Scan Time Hours: '0'
  Scan Time Minutes: '02'
  Scan Time Seconds: '25'
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus
• Example event sourced from https://github.com/NextronSystems/evtx-baseline
• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 scan has been stopped before completion.
 	Scan ID: %3
 	Scan Type: %5
 	Scan Parameters: %7
  	User: %8\%9
 	Stop Reason: %12

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Defender
  guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78
  event_source_name: ''
  event_id: 1002
  version: 0
  level: 3
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2022-04-07T17:04:28.116951+00:00'
  event_record_id: 33
  correlation: {}
  execution:
    process_id: 2680
    thread_id: 2860
  channel: Microsoft-Windows-Windows Defender/Operational
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: S-1-5-18
event_data:
  Product Name: Microsoft Defender Antivirus
  Product Version: 4.18.2104.5
  Scan ID: '{CE345D2C-02E3-48B3-8683-BF64336A98E7}'
  Scan Type Index: '1'
  Scan Type: Antimalware
  Scan Parameters Index: '1'
  Scan Parameters: Quick Scan
  Domain: NT AUTHORITY
  User: SYSTEM
  SID: S-1-5-18
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus
• Example event sourced from https://github.com/NextronSystems/evtx-baseline
• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 scan has been paused.
 	Scan ID: %3
 	Scan Type: %5
 	Scan Parameters: %7
 	User: %8\%9

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 scan has resumed.
 	Scan ID: %3
  	Scan Type: %5
 	Scan Parameters: %7
 	User: %8\%9

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 scan has encountered an error and terminated.
 	Scan ID: %3
 	Scan Type: %5
 	Scan Parameters: %7
 	User: %8\%9
 	Error Code: %11
 	Error description: %12

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has detected malware or other potentially unwanted software.
 For more information please see the following:
%15
 	Name: %11
 	ID: %12
 	Severity: %25
 	Category: %26
 	Path Found: %16
 	Detection Type: %22
 	Detection Source: %5
 	Status: %20
 	User: %8\%9
 	Process Name: %7
 	Security intelligence Version: %27
 	Engine Version: %28

Fields

Sigma Rules

• Windows Defender Threat Detected
  Detects actions taken by Windows Defender malware detection engines

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has taken action to protect this machine from malware or other potentially unwanted software.
 For more information please see the following:
%15
 	User: %8\%9
 	Name: %11
 	ID: %12
 	Severity: %25
 	Category: %26
 	Action: %20
 	Status: %7
 	Security intelligence Version: %27
 	Engine Version: %28

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has encountered an error when taking action on malware or other potentially unwanted software.
 For more information please see the following:
%15
 	User: %8\%9
 	Name: %11
 	ID: %12
 	Severity: %25
 	Category: %26
 	Path: %16
 	Action: %20
 	Error Code: %21
 	Error description: %22
 	Status: %7
 	Security intelligence Version: %27
 	Engine Version: %28

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has restored an item from quarantine.
 For more information please see the following:
%15
 	Name: %11
 	ID: %12
 	Severity: %25
 	Category: %26
 	User: %8\%9
 	Security intelligence Version: %27
 	Engine Version: %28

Fields

Sigma Rules

• Win Defender Restored Quarantine File
  Detects the restoration of files from the defender quarantine

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has encountered an error trying to restore an item from quarantine.
 For more information please see the following:
%15
 	Name: %11
 	ID: %12
 	Severity: %25
 	Category: %26
 	User: %8\%9
 	Error Code: %3
 	Error description: %4
 	Security intelligence Version: %27
 	Engine Version: %28

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has deleted an item from quarantine.
 For more information please see the following:
%15
 	Name: %11
 	ID: %12
 	Severity: %25
 	Category: %26
 	User: %8\%9
 	Security intelligence Version: %27
 	Engine Version: %28

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has encountered an error trying to delete an item from quarantine.
 For more information please see the following:
%15
 	Name: %11
 	ID: %12
 	Severity: %25
 	Category: %26
 	User: %8\%9
 	Error Code: %3
 	Error description: %4
 	Security intelligence Version: %27
 	Engine Version: %28

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has removed history of malware and other potentially unwanted software.
 	Time: %3
 	User: %8\%9

Fields

Sigma Rules

• Windows Defender Malware Detection History Deletion
  Windows Defender logs when the history of detected infections is deleted.

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has encountered an error trying to remove history of malware and other potentially unwanted software.
 	Time: %3
 	User: %8\%9
 	Error Code: %4
 	Error description: %5

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has detected a suspicious behavior.
 	Name: %11
 	ID: %12
 	Severity: %25
 	Category: %26
 	Path Found: %16
 	Detection Origin: %18
 	Detection Type: %22
 	Detection Source: %5
 	Status: %20
 	User: %8\%9
 	Process Name: %7
 	Security intelligence ID: %30
 	Security intelligence Version: %27
 	Engine Version: %28
 	Fidelity Label:  %32
 	Target File Name:  %36

Fields

Sigma Rules

• Windows Defender Threat Detected
  Detects actions taken by Windows Defender malware detection engines

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has detected malware or other potentially unwanted software.
 For more information please see the following:
%13
 	Name: %8
 	ID: %7
 	Severity: %10
 	Category: %12
 	Path: %22
 	Detection Origin: %24
 	Detection Type: %28
 	Detection Source: %18
 	User: %20
 	Process Name: %19
 	Security intelligence Version: %41
 	Engine Version: %42

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Defender
  guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78
  event_source_name: ''
  event_id: 1116
  version: 0
  level: 3
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2019-07-18T20:51:50.798995+00:00'
  event_record_id: 102
  correlation:
    ActivityID: 40013F0F-EF76-4940-A8B2-4DE50BE9AAC3
  execution:
    process_id: 6024
    thread_id: 6068
  channel: Microsoft-Windows-Windows Defender/Operational
  computer: MSEDGEWIN10
  security:
    user_id: S-1-5-18
event_data:
  Product Name: '%%827'
  Product Version: 4.18.1906.3
  Detection ID: '{37522D93-EBDD-4A5B-93B6-E984C9E3FD38}'
  Detection Time: '2019-07-18T20:40:16.697Z'
  Unused: ''
  Unused2: ''
  Threat ID: '2147708292'
  Threat Name: HackTool:JS/Jsprat
  Severity ID: '4'
  Severity Name: High
  Category ID: '34'
  Category Name: Tool
  FWLink: https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:JS/Jsprat&threatid=2147708292&enterprise=0
  Status Code: '1'
  Status Description: ''
  State: '1'
  Source ID: '3'
  Source Name: '%%818'
  Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Detection User: MSEDGEWIN10\IEUser
  Unused3: ''
  Path: containerfile:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp;
    file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0005);
    file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0037);
    file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0045);
    file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0065);
    file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1100\shells\b.jsp->(SCRIPT0068)
  Origin ID: '1'
  Origin Name: '%%845'
  Execution ID: '1'
  Execution Name: '%%813'
  Type ID: '8'
  Type Name: '%%862'
  Pre Execution Status: '0'
  Action ID: '9'
  Action Name: '%%887'
  Unused4: ''
  Error Code: '0x00000000'
  Error Description: 'The operation completed successfully. '
  Unused5: ''
  Post Clean Status: '0'
  Additional Actions ID: '0'
  Additional Actions String: No additional actions required
  Remediation User: ''
  Unused6: ''
  Signature Version: 'AV: 1.297.1333.0, AS: 1.297.1333.0, NIS: 0.0.0.0'
  Engine Version: 'AM: 1.1.16100.4, NIS: 0.0.0.0'
message: ''

Sigma Rules

• Windows Defender AMSI Trigger Detected
  Detects triggering of AMSI by Windows Defender.
• Windows Defender Threat Detected
  Detects actions taken by Windows Defender malware detection engines

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has taken action to protect this machine from malware or other potentially unwanted software.
 For more information please see the following:
%13
 	Name: %8
 	ID: %7
 	Severity: %10
 	Category: %12
 	Path: %22
 	Detection Origin: %24
 	Detection Type: %28
 	Detection Source: %18
 	User: %39
 	Process Name: %19
 	Action: %31
 	Action Status:  %38
 	Error Code: %33
 	Error description: %34
 	Security intelligence Version: %41
 	Engine Version: %42

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Defender
  guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78
  event_source_name: ''
  event_id: 1117
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2019-07-18T20:53:31.952569+00:00'
  event_record_id: 106
  correlation:
    ActivityID: 2AD0CF94-C382-4568-A488-1253A4ED0F54
  execution:
    process_id: 6024
    thread_id: 6068
  channel: Microsoft-Windows-Windows Defender/Operational
  computer: MSEDGEWIN10
  security:
    user_id: S-1-5-18
event_data:
  Product Name: '%%827'
  Product Version: 4.18.1906.3
  Detection ID: '{8791B1FB-0FE7-412E-B084-524CB5A221F3}'
  Detection Time: '2019-07-18T20:40:13.775Z'
  Unused: ''
  Unused2: ''
  Threat ID: '2147735426'
  Threat Name: Trojan:XML/Exeselrun.gen!A
  Severity ID: '5'
  Severity Name: Severe
  Category ID: '8'
  Category Name: Trojan
  FWLink: https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:XML/Exeselrun.gen!A&threatid=2147735426&enterprise=0
  Status Code: '5'
  Status Description: ''
  State: '2'
  Source ID: '3'
  Source Name: '%%818'
  Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Detection User: MSEDGEWIN10\IEUser
  Unused3: ''
  Path: file:_C:\AtomicRedTeam\atomic-red-team-master\atomics\T1086\payloads\test.xsl
  Origin ID: '1'
  Origin Name: '%%845'
  Execution ID: '1'
  Execution Name: '%%813'
  Type ID: '2'
  Type Name: '%%823'
  Pre Execution Status: '0'
  Action ID: '6'
  Action Name: '%%811'
  Unused4: ''
  Error Code: '0x80508023'
  Error Description: 'The program could not find the malware and other potentially
    unwanted software on this device. '
  Unused5: ''
  Post Clean Status: '0'
  Additional Actions ID: '0'
  Additional Actions String: No additional actions required
  Remediation User: NT AUTHORITY\SYSTEM
  Unused6: ''
  Signature Version: 'AV: 1.297.1333.0, AS: 1.297.1333.0, NIS: 0.0.0.0'
  Engine Version: 'AM: 1.1.16100.4, NIS: 0.0.0.0'
message: ''

Sigma Rules

• Windows Defender Threat Detected
  Detects actions taken by Windows Defender malware detection engines

References

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has encountered a non-critical error when taking action on malware or other potentially unwanted software.
 For more information please see the following:
%13
 	Name: %8
 	ID: %7
 	Severity: %10
 	Category: %12
 	Path: %22
 	Detection Origin: %24
 	Detection Type: %28
 	Detection Source: %18
 	User: %39
 	Process Name: %19
 	Action: %31
 	Action Status:  %38
 	Error Code: %33
 	Error description: %34
 	Security intelligence Version: %41
 	Engine Version: %42

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has encountered a critical error when taking action on malware or other potentially unwanted software.
 For more information please see the following:
%13
 	Name: %8
 	ID: %7
 	Severity: %10
 	Category: %12
 	Path: %22
 	Detection Origin: %24
 	Detection Type: %28
 	Detection Source: %18
 	User: %39
 	Process Name: %19
 	Action: %31
 	Action Status:  %38
 	Error Code: %33
 	Error description: %34
 	Security intelligence Version: %41
 	Engine Version: %42

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has deduced the hashes for a threat resource.
 	Current Platform Version: %2
 	Threat resource path: %4
 	Hashes: %5

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
 For more information please contact your IT administrator.
 	ID: %4
 	Detection time: %5
 	User: %6
 	Path: %7
 	Process Name: %8
 	Target Commandline: %12
 	Parent Commandline: %13
 	Involved File: %14
 	Inheritance Flags: %15
 	Security intelligence Version: %9
 	Engine Version: %10
 	Product Version: %2

Fields

Sigma Rules

• LSASS Access Detected via Attack Surface Reduction
  Detects Access to LSASS Process
• PSExec and WMI Process Creations Block
  Detects blocking of process creations originating from PSExec and WMI commands

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator.
 For more information please contact your IT administrator.
 	ID: %4
 	Detection time: %5
 	User: %6
 	Path: %7
 	Process Name: %8
 	Target Commandline: %12
 	Parent Commandline: %13
 	Involved File: %14
 	Inheritance Flags: %15
 	Security intelligence Version: %9
 	Engine Version: %10
 	Product Version: %2

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%8 has been blocked from modifying %7 by Controlled Folder Access.
 	Detection time: %5
 	User: %6
 	Path: %7
 	Process Name: %8
 	Security intelligence Version: %9
 	Engine Version: %10
 	Product Version: %2

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%8 would have been blocked from modifying %7 by Controlled Folder Access.
 	Detection time: %5
 	User: %6
 	Path: %7
 	Process Name: %8
 	Security intelligence Version: %9
 	Engine Version: %10
 	Product Version: %2

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

Your IT administrator would have caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
 	Detection time: %4
 	User: %5
 	Destination: %6
 	Process Name: %7

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

Your IT administrator has caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
 	Detection time: %4
 	User: %5
 	Destination: %6
 	Process Name: %7

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

Controlled Folder Access blocked %8 from making changes to memory.
 	Detection time: %5
 	User: %6
 	Path: %7
 	Process Name: %8
 	Security intelligence Version: %9
 	Engine Version: %10
 	Product Version: %2

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

Controlled Folder Access would have blocked %8 from making changes to memory.
 	Detection time: %5
 	User: %6
 	Path: %7
 	Process Name: %8
 	Security intelligence Version: %9
 	Engine Version: %10
 	Product Version: %2

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

A user has allowed a blocked Microsoft Defender Exploit Guard operation.
 	ID: %4
 	User: %5
 	Path: %6
 	Process Name: %7
 	Involved File: %8

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

{Product Name} blocked a behavior by {Source app}.

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has blocked an operation that your administrator doesn't allow.
 For more information please contact your IT administrator.
 	ID: %4
 	State: %5
 	Timestamp: %6
 	Action: %7
 	Process: %8
 	Source: %9
 	Target: %10
 	User: %11
 %Security intelligence Version: %12
 	Engine Version: %13
 	Product Version: %2

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has audited an operation.
 For more information please contact your IT administrator.
 	ID: %4
 	State: %5
 	Timestamp: %6
 	Action: %7
 	Process: %8
 	Source: %9
 	Target: %10
 	User: %11
 %Security intelligence Version: %12
 	Engine Version: %13
 	Product Version: %2

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has blocked an operation that your administrator doesn't allow.
For more information please contact your IT administrator.
	Policy Version: %4
	Policy Rule ID: %5
	Enforcement Level: %6
	Timestamp: %8
	Action Type: %9
	Process: %10
	Source: %11
	Target: %12
	Session ID: %13
	User SID: %14
%Security intelligence Version: %15
	Engine Version: %16
	Product Version: %2

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has audited an operation.
For more information please contact your IT administrator.
	Policy Version: %4
	Policy Rule ID: %5
	Enforcement Level: %6
	Audit Reason: %7
	Timestamp: %8
	Action Type: %9
	Process: %10
	Source: %11
	Target: %12
	Session ID: %13
	User SID: %14
%Security intelligence Version: %15
	Engine Version: %16
	Product Version: %2

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

Endpoint Protection client is up and running in a healthy state.
 	Platform version: %2
 	Engine version: %4
 	Security intelligence version: %5

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Defender
  guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78
  event_source_name: ''
  event_id: 1150
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-05T23:33:02.683905+00:00'
  event_record_id: 136
  correlation: {}
  execution:
    process_id: 3332
    thread_id: 4248
  channel: Microsoft-Windows-Windows Defender/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  Product Name: Microsoft Defender Antivirus
  Platform version: 4.18.23090.2008
  Unused: ''
  Engine version: 1.1.23090.2007
  Security intelligence version: 1.399.1311.0
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus
• Example event sourced from https://github.com/NextronSystems/evtx-baseline
• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

Endpoint Protection client health report (time in UTC):
 	Platform version: %2
 	Engine version: %4
 	Network Realtime Inspection engine version: %5
 	Antivirus security intelligence version: %6
 	Antispyware security intelligence version: %7
 	Network Realtime Inspection security intelligence version: %8
 	RTP state: %9
 	OA state: %10
 	IOAV state: %11
 	BM state: %12
 	Antivirus security intelligence age: %13
 	Antispyware security intelligence age: %14
 	Last quick scan age: %15
 	Last full scan age: %16
 	Antivirus security intelligence creation time: %17
 	Antispyware security intelligence creation time: %18
 	Last quick scan start time: %19
 	Last quick scan end time: %20
 	Last quick scan source: %21
 	Last full scan start time: %22
 	Last full scan end time: %23
 	Last full scan source: %24
 	Product status: %25

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Defender
  guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78
  event_source_name: ''
  event_id: 1151
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-06T01:33:02.916969+00:00'
  event_record_id: 160
  correlation: {}
  execution:
    process_id: 3332
    thread_id: 7940
  channel: Microsoft-Windows-Windows Defender/Operational
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  Product Name: Microsoft Defender Antivirus
  Platform version: 4.18.23090.2008
  Unused: ''
  Engine version: 1.1.23090.2007
  NRI engine version: 1.1.23090.2007
  AV security intelligence version: 1.399.1311.0
  AS security intelligence version: 1.399.1311.0
  NRI security intelligence version: 1.399.1311.0
  RTP state: Disabled
  OA state: Disabled
  IOAV state: Disabled
  BM state: Disabled
  Last AV security intelligence age: '11'
  Last AS security intelligence age: '11'
  Last quick scan age: '4294967295'
  Last full scan age: '4294967295'
  AV security intelligence creation time: '2023-10-25T15:24:36Z'
  AS security intelligence creation time: '2023-10-25T15:24:36Z'
  Last quick scan start time: '1601-01-01T00:00:00Z'
  Last quick scan end time: '1601-01-01T00:00:00Z'
  Last quick scan source: '0'
  Last full scan start time: '1601-01-01T00:00:00Z'
  Last full scan end time: '1601-01-01T00:00:00Z'
  Last full scan source: '0'
  Product status: '0x00080000'
  Latest engine version: 1.1.23090.2007
  Engine up-to-date: '0'
  Latest platform version: 4.18.23090.2008
  Platform up-to-date: '1'
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus
• Example event sourced from https://github.com/NextronSystems/evtx-baseline
• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has detected potentially unwanted application(PUA).
 For more information please see the following:
%13
 	Name: %8
 	ID: %7
 	Severity: %10
 	Category: %12
 	Path: %22
 	Detection Origin: %24
 	Detection Type: %28
 	Detection Source: %18
 	User: %20
 	Process Name: %19
 	Security intelligence Version: %41
 	Engine Version: %42

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 security intelligence version updated.
 	Current security intelligence Version: %3
 	Previous security intelligence Version: %4
 	Security intelligence Type: %12
 	Update Type: %14
 	User: %8\%9
 	Current Engine Version: %15
 	Previous Engine Version: %16

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Defender
  guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78
  event_source_name: ''
  event_id: 2000
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-10-25T21:44:41.065306+00:00'
  event_record_id: 38
  correlation: {}
  execution:
    process_id: 2976
    thread_id: 4276
  channel: Microsoft-Windows-Windows Defender/Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-18
event_data:
  Product Name: Microsoft Defender Antivirus
  Product Version: 4.18.2201.11
  Current security intelligence Version: 1.399.1311.0
  Previous security intelligence Version: 1.321.69.0
  Unused: ''
  Unused2: ''
  Unused3: ''
  Domain: NT AUTHORITY
  User: SYSTEM
  SID: S-1-5-18
  Security intelligence Type Index: '2'
  Security intelligence Type: AntiSpyware
  Update Type Index: '1'
  Update Type: Full
  Current Engine Version: 1.1.23090.2007
  Previous Engine Version: 1.1.17300.4
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus
• Example event sourced from https://github.com/NextronSystems/evtx-baseline
• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 has encountered an error trying to update security intelligence.
 	New security intelligence Version: %3
 	Previous security intelligence Version: %4
 	Update Source: %6
 	Security intelligence Type: %12
 	Update Type: %14
 	User: %8\%9
 	Current Engine Version: %15
 	Previous Engine Version: %16
 	Error code: %17
 	Error description: %18

Fields

References

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Message

%1 engine version has been updated.
 	Current Engine Version: %3
 	Previous Engine Version: %4
 	User: %8\%9

Fields

Example Event

system:
  provider: Microsoft-Windows-Windows Defender
  guid: 11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78
  event_source_name: ''
  event_id: 2002
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-10-25T21:44:41.062981+00:00'
  event_record_id: 36
  correlation: {}
  execution:
    process_id: 2976
    thread_id: 4276
  channel: Microsoft-Windows-Windows Defender/Operational
  computer: WinDevEval
  security:
    user_id: S-1-5-18
event_data:
  Product Name: Microsoft Defender Antivirus
  Product Version: 4.18.2201.11
  Current Engine Version: 1.1.23090.2007
  Previous Engine Version: 1.1.17300.4
  Unused: ''
  Unused2: ''
  Unused3: ''
  Domain: NT AUTHORITY
  User: SYSTEM
  SID: S-1-5-18
  Unused4: ''
  Unused5: ''
  Feature Index: '0'
  Feature Name: Antimalware
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus
• Example event sourced from https://github.com/NextronSystems/evtx-baseline
• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/