WindowsDefender
Windows Defender Data
- 9 paths
Microsoft-Windows-Windows Defender*.evtxMpCmdRun.logDetections.log- Version 1
- Drew Ervin
Paths on disk
9 paths
References
5 links
- knez.github.io/posts/how-to-extract-quarantine-files-from-windows-defender/(opens in new tab)
- crowdstrike.com/blog/how-to-use-microsoft-protection-logging-for-forensic-investigations/(opens in new tab)
- github.com/jklepsercyber/defender-detectionhistory-parser/blob/main/README.md(opens in new tab)
- forensafe.com/blogs/windows_defender.html(opens in new tab)
- thedfirspot.com/post/windows-defender-mp-logs-a-story-of-artifacts(opens in new tab)