Event ID 1122 — Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator.

Description

Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator.

Message #

Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator.
 For more information please contact your IT administrator.
 	ID: %4
 	Detection time: %5
 	User: %6
 	Path: %7
 	Process Name: %8
 	Target Commandline: %12
 	Parent Commandline: %13
 	Involved File: %14
 	Inheritance Flags: %15
 	Security intelligence Version: %9
 	Engine Version: %10
 	Product Version: %2

Fields #

Related Events #

References #

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/