DFIRHub

Windows event log · Microsoft-Windows-Windows Defender/Operational1008 Error - The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.

  • Defender and policy
  • 5 fields
  • Microsoft-Windows-Windows Defender%4Operational.evtx
  • Microsoft-Windows-Windows Defender

Fields EvtxECmd extracts

5 columns in the EvtxECmd CSV

  • UserName%Domain%\%User%
    • %Domain% = /Event/EventData/Data[@Name="Domain"]
    • %User% = /Event/EventData/Data[@Name="User"]
  • PayloadData1Threat Name: %ThreatName%
    • %ThreatName% = /Event/EventData/Data[@Name="Threat Name"]
  • PayloadData2Severity: %SeverityID%:%SeverityName% -- Category: %CategoryName%
    • %SeverityID% = /Event/EventData/Data[@Name="Severity ID"]
    • %SeverityName% = /Event/EventData/Data[@Name="Severity Name"]
    • %CategoryName% = /Event/EventData/Data[@Name="Category Name"]
  • PayloadData3Link: %FWLink%
    • %FWLink% = /Event/EventData/Data[@Name="FWLink"]
  • PayloadData5Error code & Description: %Code% \ %Description%
    • %Code% = /Event/EventData/Data[@Name="Error Code"]
    • %Description% = /Event/EventData/Data[@Name="Error Description"]

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}"/>
    <EventID>1008</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-01-01T00:00:01.012345678Z"/>
    <EventRecordID>308</EventRecordID>
    <Correlation ActivityID="{a1620c32-6760-42f2-ac32-572a411f4625}"/>
    <Execution ProcessID="3956" ThreadID="2512"/>
    <Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
    <Computer>hostname.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="Product Name">%%827</Data>
    <Data Name="Product Version">6.1.7601.18170</Data>
    <Data Name="Detection ID">{894C2763-E3AB-4658-BA12-70BDA57C6D07}</Data>
    <Data Name="Unused"></Data>
    <Data Name="Unused2"></Data>
    <Data Name="Status Code">0</Data>
    <Data Name="Status Description"></Data>
    <Data Name="Domain"></Data>
    <Data Name="User"></Data>
    <Data Name="SID"></Data>
    <Data Name="Threat Name">PWS:Win32/Fareit.gen!E</Data>
    <Data Name="Threat ID">170611</Data>
    <Data Name="Severity ID">5</Data>
    <Data Name="Category ID">3</Data>
    <Data Name="FWLink">http://go.microsoft.com/fwlink/?linkid=37020&amp;name=PWS:Win32/Fareit.gen!E&amp;threatid=170611</Data>
    <Data Name="Path Found"></Data>
    <Data Name="Unused3"></Data>
    <Data Name="Unused4"></Data>
    <Data Name="Cleaning Action Index">3</Data>
    <Data Name="Cleaning Action">%%808</Data>
    <Data Name="Error Code">0x80508023</Data>
    <Data Name="Error Description">The program could not find the spyware and other potentially unwanted software on this computer.</Data>
    <Data Name="Unused5"></Data>
    <Data Name="Unused6"></Data>
    <Data Name="Severity Name">Severe</Data>
    <Data Name="Category Name">Password Stealer</Data>
  </EventData>
</Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-Windows-Defender-Operational_Microsoft-Windows-Windows-Defender_1008.map(opens in new tab) by Brian MacKenna and contributors(opens in new tab), MIT License(opens in new tab)