Event 1129: A user has allowed a blocked Microsoft Defender Exploit Guard operation. — Mi…

Description

A user has allowed a blocked Microsoft Defender Exploit Guard operation.

Message #

A user has allowed a blocked Microsoft Defender Exploit Guard operation.
 	ID: %4
 	User: %5
 	Path: %6
 	Process Name: %7
 	Involved File: %8

Fields #

Name	Description
`ProductName` UnicodeString	—
`ProductVersion` UnicodeString	—
`Unused` UnicodeString	—
`ID` UnicodeString	—
`User` UnicodeString	—
`Path` UnicodeString	—
`ProcessName` UnicodeString	—
`InvolvedFile` UnicodeString	—

Related Events #

Windows-Defender Event ID 1121: Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
Appear together in 2 Splunk detection rules
- Splunk Windows Defender ASR Block Events
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1122: Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1125: Your IT administrator would have caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1126: Your IT administrator has caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
Appear together in 2 Splunk detection rules
- Splunk Windows Defender ASR Block Events
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1131: ProductName has blocked an operation that your administrator doesn't allow.
Appear together in 2 Splunk detection rules
- Splunk Windows Defender ASR Block Events
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1132: ProductName has audited an operation.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1133: ProductName has blocked an operation that your administrator doesn't allow.
Appear together in 2 Splunk detection rules
- Splunk Windows Defender ASR Block Events
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 1134: ProductName has audited an operation.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking
Windows-Defender Event ID 5007: Product Name Configuration has changed.
Appear together in 1 Splunk detection rule
- Splunk Windows Defender ASR Rules Stacking

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/

Event ID 1129 — A user has allowed a blocked Microsoft Defender Exploit Guard operation.

Description

Message #

Fields #

References #

Keyboard Shortcuts