Detection rules › Sigma
Microsoft Defender massive virus outbreach
Detects scenarios where a same threat is detected on different hosts in a short period of time
Known false positives
- EICAR test file
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Windows-Defender | Event ID 1116: Product Name has detected malware or other potentially unwanted software. |
Rule body
title: Microsoft Defender massive virus outbreach
description: Detects scenarios where a same threat is detected on different hosts in a short period of time
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/Antivirus
tags:
- malware
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: windefend
detection:
selection:
EventID: 1116 # Threat detected, no action taken
condition: selection | count(Computer) by ThreatName > 10
timeframe: 30m
falsepositives:
- EICAR test file
level: high
Stages and Predicates
Stage 0: condition
selection | count(Computer) by ThreatName > 10Stage 1: selection
selection:
EventID: 1116