Microsoft Defender Antivirus logs

Detections, the actions taken on them, and the configuration changes that stopped detections happening. The third of those is the one that matters in a ransomware case.

windows · Execution · T1562.001T1070.004

where it lives

Microsoft-Windows-Windows Defender%4Operational.evtx

Windows 10, 11 and Server 2016+

Event 1116 for a detection, 1117 for the action taken, 5001 for real-time protection being disabled, 5007 for a configuration change.

%PROGRAMDATA%\Microsoft\Windows Defender\Support\MPLog-*.log

All

Verbose, includes scanned paths and process names, and survives longer than the event channel.

what it proves

  • That a file was detected, what it was identified as, and what was done with it
  • That real-time protection was turned off, and when, in event 5001
  • Exclusions added to the configuration, in event 5007, which is a persistence and evasion move in its own right
  • Paths scanned and processes seen, in MPLog, which frequently names files that no longer exist

what it does not prove

  • That a detection means the threat was stopped. 1116 without a matching 1117 is a detection with no action
  • That an absence of detections means an absence of malware. It means an absence of signatures for it
  • That the product was running. A host with protection disabled produces a quiet log, not an empty one

parsing it

  • EvtxECmd (Eric Zimmerman)
  • Get-WinEvent
  • Any text editor for MPLog

tampering and anti-forensics

Adding an exclusion is quieter than disabling protection and achieves more for an operator. Event 5007 is the one to alert on, and almost nobody does.

how long it survives

Channel-capped for the event log. MPLog files rotate and frequently hold weeks.

where this comes from

read next

sysmon operational · powershell script block

Verify against the host in front of you before this reaches a report. Paths and behaviour move between Windows builds, and a documented default is not necessarily the setting on that machine. Corrections are published.