DFIRHub

Windows event log · Microsoft-Windows-Windows Defender/Operational1117 Detection - The antimalware platform performed an action to protect your system from malware or other potentially unwanted software

  • Defender and policy
  • 7 fields
  • Microsoft-Windows-Windows Defender%4Operational.evtx
  • Microsoft-Windows-Windows Defender

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • UserNameDetection User: %User%
    • %User% = /Event/EventData/Data[@Name="Detection User"]
  • ExecutableInfo%DetectionPath%
    • %DetectionPath% = /Event/EventData/Data[@Name="Path"]
  • PayloadData1Malware name: %ThreatName%
    • %ThreatName% = /Event/EventData/Data[@Name="Threat Name"]
  • PayloadData2Description: %Category% (%Severity%)
    • %Category% = /Event/EventData/Data[@Name="Category Name"]
    • %Severity% = /Event/EventData/Data[@Name="Severity Name"]
  • PayloadData3Detection Time: %Time%
    • %Time% = /Event/EventData/Data[@Name="Detection Time"]
  • PayloadData4Process (if real-time detection): %Process%
    • %Process% = /Event/EventData/Data[@Name="Process Name"]
  • PayloadData5Detection ID: %DetectionID%
    • %DetectionID% = /Event/EventData/Data[@Name="Detection ID"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}"/>
    <EventID>1117</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-07-13T13:14:44.410427800Z"/>
    <EventRecordID>186</EventRecordID>
    <Correlation/>
    <Execution ProcessID="3536" ThreadID="3948"/>
    <Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
    <Computer>Thunder.cloud.corp.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="Product Name">%%827</Data>
    <Data Name="Product Version">4.18.1907.4</Data>
    <Data Name="Detection ID">{A3A6A7BE-20E5-4E55-BDAA-A218EB402A47}</Data>
    <Data Name="Detection Time">2019-07-13T13:14:42.582Z</Data>
    <Data Name="Unused"/>
    <Data Name="Unused2"/>
    <Data Name="Threat ID">2147726780</Data>
    <Data Name="Threat Name">Trojan:Win32/Occamy.C</Data>
    <Data Name="Severity ID">5</Data>
    <Data Name="Severity Name">Severe</Data>
    <Data Name="Category ID">8</Data>
    <Data Name="Category Name">Trojan</Data>
    <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Occamy.C&threatid=2147726780&enterprise=0</Data>
    <Data Name="Status Code">1</Data>
    <Data Name="Status Description"/>
    <Data Name="State">1</Data>
    <Data Name="Source ID">3</Data>
    <Data Name="Source Name">%%818</Data>
    <Data Name="Process Name">C:\Windows\explorer.exe</Data>
    <Data Name="Detection User">Cloud\BadUser</Data>
    <Data Name="Unused3"/>
    <Data Name="Path">file:_C:\svchost\svchost.exe</Data>
    <Data Name="Origin ID">1</Data>
    <Data Name="Origin Name">%%845</Data>
    <Data Name="Execution ID">1</Data>
    <Data Name="Execution Name">%%813</Data>
    <Data Name="Type ID">0</Data>
    <Data Name="Type Name">%%822</Data>
    <Data Name="Pre Execution Status">0</Data>
    <Data Name="Action ID">9</Data>
    <Data Name="Action Name">%%887</Data>
    <Data Name="Unused4"/>
    <Data Name="Error Code">0x00000000</Data>
    <Data Name="Error Description">The operation completed successfully.</Data>
    <Data Name="Unused5"/>
    <Data Name="Post Clean Status">0</Data>
    <Data Name="Additional Actions ID">0</Data>
    <Data Name="Additional Actions String">No additional actions required</Data>
    <Data Name="Remediation User"/>
    <Data Name="Unused6"/>
    <Data Name="Signature Version">AV: 1.301.1131.0, AS: 1.301.1131.0, NIS: 1.301.1131.0</Data>
    <Data Name="Engine Version">AM: 1.1.12300.1, NIS: 1.1.12300.1</Data>
  </EventData>
</Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-Windows-Defender-Operational_Microsoft-Windows-Windows-Defender_1117.map(opens in new tab) by Troy Larson and contributors(opens in new tab), MIT License(opens in new tab)