DFIRHub

Windows event log · Microsoft-Windows-Windows Defender/Operational1006 Detection - The antimalware engine found malware or other potentially unwanted software

  • Defender and policy
  • 4 fields
  • Microsoft-Windows-Windows Defender%4Operational.evtx
  • Microsoft-Windows-Windows Defender

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • UserName%Domain%\%User%
    • %Domain% = /Event/EventData/Data[@Name="Domain"]
    • %User% = /Event/EventData/Data[@Name="User"]
  • PayloadData1Threat Name: %ThreatName%
    • %ThreatName% = /Event/EventData/Data[@Name="Threat Name"]
  • PayloadData2Severity: %SeverityID%:%SeverityName% -- Category: %CategoryName%
    • %SeverityID% = /Event/EventData/Data[@Name="Severity ID"]
    • %SeverityName% = /Event/EventData/Data[@Name="Severity Name"]
    • %CategoryName% = /Event/EventData/Data[@Name="Category Name"]
  • PayloadData3Link: %FWLink%
    • %FWLink% = /Event/EventData/Data[@Name="FWLink"]

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}"/>
    <EventID>1006</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-01-01T00:00:01.012345678Z"/>
    <EventRecordID>303</EventRecordID>
    <Correlation/>
    <Execution ProcessID="3956" ThreadID="9712"/>
    <Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
    <Computer>hostname.domain.tld</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="Product Name">%%827</Data>
    <Data Name="Product Version">6.1.7601.18170</Data>
    <Data Name="Detection ID">{FC6CB97E-8309-43F1-953F-7F51883330B5}</Data>
    <Data Name="Detection Source Index">3</Data>
    <Data Name="Detection Source">%%818</Data>
    <Data Name="Unused"></Data>
    <Data Name="Process Name"></Data>
    <Data Name="Domain"></Data>
    <Data Name="User"></Data>
    <Data Name="SID"></Data>
    <Data Name="Threat Name">PWS:Win32/Fareit.gen!E</Data>
    <Data Name="Threat ID">170611</Data>
    <Data Name="Severity ID">5</Data>
    <Data Name="Category ID">3</Data>
    <Data Name="FWLink">http://go.microsoft.com/fwlink/?linkid=37020&amp;name=PWS:Win32/Fareit.gen!E&amp;threatid=170611</Data>
    <Data Name="Path Found">process:pid:9660</Data>
    <Data Name="Unused2"></Data>
    <Data Name="Unused3"></Data>
    <Data Name="Execution Status Index">0</Data>
    <Data Name="Execution Status">%%812</Data>
    <Data Name="Detection Type Index">2</Data>
    <Data Name="Detection Type">%%823</Data>
    <Data Name="Unused4"></Data>
    <Data Name="Unused5"></Data>
    <Data Name="Severity Name">Severe</Data>
    <Data Name="Category Name">Password Stealer</Data>
  </EventData>
</Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-Windows-Defender-Operational_Microsoft-Windows-Windows-Defender_1006.map(opens in new tab) by Brian MacKenna and contributors(opens in new tab), MIT License(opens in new tab)