win:defender
Microsoft Defender Antivirus operational log
Channel: Microsoft-Windows-Windows Defender/Operational
- Host type
- Windows (workstation, member server, domain controller)
- Cost class
- Included
- Techniques
- 4
- Rules listed
- 32
- Events
- 33
Licensing
- License or service
- Microsoft Defender Antivirus (in-box)
- What is free
- Microsoft-Windows-Windows Defender/Operational channel
- What costs
- Nothing for the local log
- Notes
- Page applies to AV and MDE P1/P2; no license gate stated for the local log
- Vendor page
- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Security tooling alerts | Supports an activity | our analysis: antivirus detections |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted: security-related and critical software |
Techniques
Rules
Splunk 6
Sigma 26
- Antivirus - APT Malware Signature by Arnim Rupp (Nextron Systems)
- Antivirus - Exploitation Framework Signature by Florian Roth (Nextron Systems), Arnim Rupp
- Antivirus - Hacktool Signature by Florian Roth (Nextron Systems), Arnim Rupp
- Antivirus - Password Dumper Signature by Florian Roth (Nextron Systems), Arnim Rupp
- Antivirus - Ransomware Signature by Florian Roth (Nextron Systems), Arnim Rupp
- Antivirus - Relevant File Paths Alerts Signature by Florian Roth (Nextron Systems), Arnim Rupp
- Antivirus - Remote Access Tools Signature by Arnim Rupp (Nextron Systems)
- Antivirus - Web Shell Detection Signature by Florian Roth (Nextron Systems), Arnim Rupp
- Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection by Sittikorn S, Nuttakorn T, Tim Shelton
- LSASS Access Detected via Attack Surface Reduction by Markus Neis
- Microsoft Defender Tamper Protection Trigger by Bhabesh Raj, Nasreddine Bencherchali
- PSExec and WMI Process Creations Block by Bhabesh Raj
- RedSun - TieringEngineService.exe Detected as EICAR Test File by Swachchhanda Shrawan Poudel (Nextron Systems)
- Win Defender Restored Quarantine File by Nasreddine Bencherchali (Nextron Systems)
- Windows Defender AMSI Trigger Detected by Bhabesh Raj
- Windows Defender Configuration Changes by Nasreddine Bencherchali (Nextron Systems)
- Windows Defender Exclusions Added by Christian Burkard (Nextron Systems)
- Windows Defender Exploit Guard Tamper by Nasreddine Bencherchali (Nextron Systems)
- Windows Defender Grace Period Expired by Ján Trenčanský, frack113
- Windows Defender Malware And PUA Scanning Disabled by Ján Trenčanský, frack113
- Windows Defender Malware Detection History Deletion by Cian Heasley
- Windows Defender Real-Time Protection Failure/Restart by Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update)
- Windows Defender Real-time Protection Disabled by Ján Trenčanský, frack113
- Windows Defender Submit Sample Feature Disabled by Nasreddine Bencherchali (Nextron Systems)
- Windows Defender Threat Detected by Ján Trenčanský
- Windows Defender Virus Scanning Feature Disabled by Ján Trenčanský, frack113
Events
Recommended (15)
- 1005Scan Failed
- 1006Detected Malware
- 1007Malware Removed
- 1008Action on Malware Failed
- 1009File Restored from Quarantine
- 1010Failed to remove item from quarantine
- 1116Detected Malware
- 1117Malware Removed
- 1118Malware Removal Error
- 1119Malware Removal Fatal Error
- 2001Failed to update signatures
- 2003Failed to update engine
- 2004Reverting to last known good set of signatures
- 3002Real-Time Protection failed
- 5008Unexpected Error