DFIRHub

Windows event log · Microsoft-Windows-Windows Defender/Operational1011 The antimalware platform deleted an item from quarantine

  • Defender and policy
  • 4 fields
  • Microsoft-Windows-Windows Defender%4Operational.evtx
  • Microsoft-Windows-Windows Defender

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • UserName%Domain%\%User%
    • %Domain% = /Event/EventData/Data[@Name="Domain"]
    • %User% = /Event/EventData/Data[@Name="User"]
  • ExecutableInfo%DetectionPath%
    • %DetectionPath% = /Event/EventData/Data[@Name="Path"]
  • PayloadData1Malware name: %ThreatName%
    • %ThreatName% = /Event/EventData/Data[@Name="Threat Name"]
  • PayloadData2Description: %Category% (%Severity%)
    • %Category% = /Event/EventData/Data[@Name="Category Name"]
    • %Severity% = /Event/EventData/Data[@Name="Severity Name"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}"/>
    <EventID>1011</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-08-29T20:57:40.877718500Z"/>
    <EventRecordID>31419</EventRecordID>
    <Correlation ActivityID="{7ad8b4ae-dc2d-4d8a-81cc-04a1895c0a23}"/>
    <Execution ProcessID="767" ThreadID="1600"/>
    <Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
    <Computer>Thunder.cloud.corp.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="Product Name">%%827</Data>
    <Data Name="Product Version">4.18.1910.4</Data>
    <Data Name="Unused"/>
    <Data Name="Unused2"/>
    <Data Name="Unused3"/>
    <Data Name="Unused4"/>
    <Data Name="Unused5"/>
    <Data Name="Domain">CLOUD</Data>
    <Data Name="User">Storm</Data>
    <Data Name="SID">S-1-5-21-1234567890-1234567890-1234567890-123456</Data>
    <Data Name="Threat Name">HackTool:Win32/NLBrute</Data>
    <Data Name="Threat ID">2147723627</Data>
    <Data Name="Severity ID">4</Data>
    <Data Name="Category ID">34</Data>
    <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:Win32/NLBrute&threatid=2147723627&enterprise=1</Data>
    <Data Name="Path">file:_H:\Cases\mbr0\2623afb1-faa2-4792-a04d-78d3e5086b16.bin</Data>
    <Data Name="Unused6"/>
    <Data Name="Unused7"/>
    <Data Name="Unused8"/>
    <Data Name="Unused9"/>
    <Data Name="Unused10"/>
    <Data Name="Unused11"/>
    <Data Name="Unused12"/>
    <Data Name="Unused13"/>
    <Data Name="Severity Name">High</Data>
    <Data Name="Category Name">Tool</Data>
    <Data Name="Signature Version">AV: 1.305.927.0, AS: 1.305.927.0</Data>
    <Data Name="Engine Version">1.1.16500.1</Data>
  </EventData>
</Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-Windows-Defender-Operational_Microsoft-Windows-Windows-Defender_1011.map(opens in new tab) by Troy Larson and contributors(opens in new tab), MIT License(opens in new tab)