Event 1125: Your IT administrator would have caused Microsoft Defender Exploit Guard to b…

Description

Your IT administrator would have caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.

Message #

Your IT administrator would have caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
 	Detection time: %4
 	User: %5
 	Destination: %6
 	Process Name: %7

Fields #

Name	Description
`ProductName` UnicodeString	—
`ProductVersion` UnicodeString	—
`ID` UnicodeString	—
`DetectionTime` UnicodeString	—
`User` UnicodeString	—
`Destination` UnicodeString	—
`ProcessName` UnicodeString	—

Related Events #

Windows-Defender Event ID 1121: Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1122: Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator.
Appear together in 2 Splunk detection rules
- Splunk Windows Defender ASR Audit Events
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1126: Your IT administrator has caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
Appear together in 2 Splunk detection rules
- Splunk Windows Defender ASR Audit Events
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1129: A user has allowed a blocked Microsoft Defender Exploit Guard operation.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1131: ProductName has blocked an operation that your administrator doesn't allow.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1132: ProductName has audited an operation.
Appear together in 2 Splunk detection rules
- Splunk Windows Defender ASR Audit Events
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1133: ProductName has blocked an operation that your administrator doesn't allow.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1134: ProductName has audited an operation.
Appear together in 2 Splunk detection rules
- Splunk Windows Defender ASR Audit Events
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 5007: Product Name Configuration has changed.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Event ID 1125 — Your IT administrator would have caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.

Description

Message #

Fields #

References #

Keyboard Shortcuts