DFIRHub

Windows event log ยท Microsoft-Windows-Windows Defender/Operational2050 Defender uploaded a file for further analysis

  • Defender and policy
  • 2 fields
  • Microsoft-Windows-Windows Defender%4Operational.evtx
  • Microsoft-Windows-Windows Defender

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1SHA256: %Sha256%
    • %Sha256% = /Event/EventData/Data[@Name="Sha256"]
  • ExecutableInfo%Filename%
    • %Filename% = /Event/EventData/Data[@Name="Filename"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Windows Defender" Guid="11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78"/>
    <EventID>2050</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2022-02-19 01:13:39.3131234"/>
    <EventRecordID>56774</EventRecordID>
    <Correlation ActivityID="eeabc537-e19e-4238-bb37-dd1dc23486cb"/>
    <Execution ProcessID="3454" ThreadID="11252"/>
    <Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
    <Computer>hostname.DOMAIN</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="Product Name">Microsoft Defender Antivirus</Data>
    <Data Name="Product Version">4.18.2303.8</Data>
    <Data Name="Filename">C:\evil.exe</Data>
    <Data Name="Sha256">abcd38c2b76aaebd3cf08eb47eaa721abce297799e9410195fc7abcce123456</Data>
  </EventData>
</Event>

Source: evtx/Maps/Microsoft-Windows-Windows-Defender-Operational_Microsoft-Windows-Windows-Defender_2050.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)