Detection rules › By event

Microsoft-Windows-Windows-Defender

Event	Rules
Event ID 1006	1
Event ID 1009	1
Event ID 1013	1
Event ID 1015	1
Event ID 1116	4
Event ID 1117	1
Event ID 1119	1
Event ID 1121	5
Event ID 1122	3
Event ID 1125	2
Event ID 1126	3
Event ID 1129	2
Event ID 1131	2
Event ID 1132	2
Event ID 1133	2
Event ID 1134	2
Event ID 1151	1
Event ID 3002	2
Event ID 3007	1
Event ID 5001	1
Event ID 5007	8
Event ID 5010	1
Event ID 5012	1
Event ID 5013	1
Event ID 5101	1

Event ID 1006

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Threat Detected severity high T1059

Event ID 1009

1 detection rules reference this event. View event page.

Sigma (1)

Win Defender Restored Quarantine File severity high T1685

Event ID 1013

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Malware Detection History Deletion severity informational

Event ID 1015

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Threat Detected severity high T1059

Event ID 1116

4 detection rules reference this event. View event page.

Sigma (4)

Microsoft Defender massive host infection severity high
Microsoft Defender massive virus outbreach severity high
Windows Defender AMSI Trigger Detected severity high T1059
Windows Defender Threat Detected severity high T1059

Event ID 1117

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Threat Detected severity high T1059

Event ID 1119

1 detection rules reference this event. View event page.

Sigma (1)

RedSun - TieringEngineService.exe Detected as EICAR Test File severity critical T1036, T1036.005, T1055, T1685

Event ID 1121

5 detection rules reference this event. View event page.

Sigma (2)

LSASS Access Detected via Attack Surface Reduction severity high T1003, T1003.001
PSExec and WMI Process Creations Block severity high T1047, T1569, T1569.002

Splunk (2)

Windows Defender ASR Block Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Kusto (1)

ASR Rare and Untrusted Executables

Event ID 1122

3 detection rules reference this event. View event page.

Splunk (2)

Windows Defender ASR Audit Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Kusto (1)

ASR Rare and Untrusted Executables

Event ID 1125

2 detection rules reference this event. View event page.

Splunk (2)

Windows Defender ASR Audit Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Event ID 1126

3 detection rules reference this event. View event page.

Splunk (3)

Windows Defender ASR Audit Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Block Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Event ID 1129

2 detection rules reference this event. View event page.

Splunk (2)

Windows Defender ASR Block Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Event ID 1131

2 detection rules reference this event. View event page.

Splunk (2)

Windows Defender ASR Block Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Event ID 1132

2 detection rules reference this event. View event page.

Splunk (2)

Windows Defender ASR Audit Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Event ID 1133

2 detection rules reference this event. View event page.

Splunk (2)

Windows Defender ASR Block Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Event ID 1134

2 detection rules reference this event. View event page.

Splunk (2)

Windows Defender ASR Audit Events severity low T1059, T1566, T1566.001, T1566.002
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Event ID 1151

1 detection rules reference this event. View event page.

Sigma (1)

Microsoft Defender signatures not up to date severity medium

Event ID 3002

2 detection rules reference this event. View event page.

Sigma (2)

Microsoft Defender real time protection failure (native) severity high T1685
Windows Defender Real-Time Protection Failure/Restart severity medium T1685

Event ID 3007

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Real-Time Protection Failure/Restart severity medium T1685

Event ID 5001

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Real-time Protection Disabled severity high T1685

Event ID 5007

8 detection rules reference this event. View event page.

Sigma (5)

Microsoft Defender threat exclusion added (native) severity high T1685
Windows Defender Configuration Changes severity high T1685
Windows Defender Exclusions Added severity medium T1685
Windows Defender Exploit Guard Tamper severity high T1685
Windows Defender Submit Sample Feature Disabled severity low T1685

Splunk (3)

Windows Defender ASR Registry Modification T1112
Windows Defender ASR Rule Disabled severity medium T1112
Windows Defender ASR Rules Stacking T1059, T1566, T1566.001, T1566.002

Event ID 5010

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Malware And PUA Scanning Disabled severity high T1685

Event ID 5012

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Virus Scanning Feature Disabled severity high T1685

Event ID 5013

1 detection rules reference this event. View event page.

Sigma (1)

Microsoft Defender Tamper Protection Trigger severity high T1685

Event ID 5101

1 detection rules reference this event. View event page.

Sigma (1)

Windows Defender Grace Period Expired severity high T1685