detection.wiki

Detection rules › Sigma

Microsoft Defender massive host infection

Status
experimental
Severity
high
Time window
30m
Log source
product windows, service windefend
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where multiple suspicious threats are detected on a single host

Event coverage

ProviderEvent
Windows-DefenderEvent ID 1116

Rule body yaml

title: Microsoft Defender massive host infection
description: Detects scenarios where multiple suspicious threats are detected on a single host
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/Antivirus
tags:
- malware
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 1116 # Threat detected, no action taken
  condition: selection | count(ThreatName) by Computer > 5
  timeframe: 30m
falsepositives:
- EICAR test file
level: high

Stages and Predicates

Stage 0: condition

selection | count(ThreatName) by Computer > 5

Stage 1: selection

selection:
  EventID: 1116
Threshold
> 5