Microsoft Defender Antivirus logs
Detections, the actions taken on them, and the configuration changes that stopped detections happening. The third of those is the one that matters in a ransomware case.
where it lives
Microsoft-Windows-Windows Defender%4Operational.evtxEvent 1116 for a detection, 1117 for the action taken, 5001 for real-time protection being disabled, 5007 for a configuration change.
%PROGRAMDATA%\Microsoft\Windows Defender\Support\MPLog-*.logVerbose, includes scanned paths and process names, and survives longer than the event channel.
what it proves
- That a file was detected, what it was identified as, and what was done with it
- That real-time protection was turned off, and when, in event 5001
- Exclusions added to the configuration, in event 5007, which is a persistence and evasion move in its own right
- Paths scanned and processes seen, in MPLog, which frequently names files that no longer exist
what it does not prove
- That a detection means the threat was stopped. 1116 without a matching 1117 is a detection with no action
- That an absence of detections means an absence of malware. It means an absence of signatures for it
- That the product was running. A host with protection disabled produces a quiet log, not an empty one
parsing it
EvtxECmd (Eric Zimmerman)Get-WinEventAny text editor for MPLog
tampering and anti-forensics
Adding an exclusion is quieter than disabling protection and achieves more for an operator. Event 5007 is the one to alert on, and almost nobody does.
how long it survives
Channel-capped for the event log. MPLog files rotate and frequently hold weeks.