Event ID 1121 — Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.

Description

Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.

Message #

Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
 For more information please contact your IT administrator.
 	ID: %4
 	Detection time: %5
 	User: %6
 	Path: %7
 	Process Name: %8
 	Target Commandline: %12
 	Parent Commandline: %13
 	Involved File: %14
 	Inheritance Flags: %15
 	Security intelligence Version: %9
 	Engine Version: %10
 	Product Version: %2

Fields #

Related Events #

References #

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/