Detection of Windows Defender Malware and Suspicious Activity Events

This brief focuses on the operational visibility provided by Windows Defender's native logging capabilities, specifically regarding malware and suspicious activity detections. Security operations teams can leverage Event IDs 1006, 1015, 1116, and 1117 to identify when the antimalware engine blocks malicious files or identifies potentially unwanted programs (PUPs). Monitoring these events is essential for incident response, as they provide high-fidelity indicators that a security control has engaged to protect the endpoint. These logs facilitate the identification of compromised hosts, persistent threat attempts, and the efficacy of current defensive policies. Defenders should ingest these events to maintain situational awareness of security product triggers across the fleet.

Impact

Successful detection of these events allows for the rapid identification of active threats on an endpoint. If these detections are ignored, attackers may maintain persistence through obfuscated malware or bypass security controls by repeatedly attempting to execute known malicious binaries that have already been flagged by the system.

Recommendation

• Deploy the Sigma rules below to your SIEM to monitor for high-confidence security triggers.
• Configure the Windows Event Log collection to capture Microsoft-Windows-Windows Defender/Operational logs.
• Integrate these detections into your automated incident response playbooks for rapid host isolation upon a confirmed malware detection (Event ID 1116).
• Review the frequency of these detections per endpoint to identify systems that may be repeatedly targeted or infected, indicating a need for deeper forensic investigation.