Detection: Windows Defender Threat Detected on Kernel Object Path

Updated Date: 2026-08-18 ID: 702631e8-90ce-43db-90fd-cf0228edc8ad Author: Onur Mustafa Erdogan, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot). It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity. In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32. If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.

Search

 1`ms_defender`
 2EventCode IN (1116, 1117)
 3Path="*\\globalroot\\*"
 4
 5| fillnull
 6
 7| stats count min(_time) as firstTime
 8              max(_time) as lastTime
 9              values(EventCode) as EventCode
10              values(Action_Name) as Action_Name
11              values(Additional_Actions_String) as Additional_Actions_String
12              values(FWLink) as FWLink
13  by dvc Detection_User Path Threat_Name Severity_Name Category_Name
14
15| rename dvc as dest, Detection_User as user
16
17| `security_content_ctime(firstTime)`
18
19| `security_content_ctime(lastTime)`
20
21| `windows_defender_threat_detected_on_kernel_object_path_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Defender 1116	Windows	`'XmlWinEventLog'`	`'WinEventLog:Microsoft-Windows-Windows Defender/Operational'`
Windows Event Log Defender 1117	Windows	`'XmlWinEventLog'`	`'WinEventLog:Microsoft-Windows-Windows Defender/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
windows_defender_threat_detected_on_kernel_object_path_filter	`search *`

windows_defender_threat_detected_on_kernel_object_path_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1211	Exploitation for Stealth	Stealth

Exploitation

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line, via the Splunk Add-on for Microsoft Windows. Ensure the Microsoft-Windows-Windows Defender/Operational channel is being collected so that EventCode 1116 (detection) and 1117 (remediation) events are ingested.

Known False Positives

No false positives have been identified at this time. Legitimate Defender scans do not report detections against paths resolved through the NT object manager namespace.

Associated Analytic Story

RoguePlanet

Finding

Title	Entity Field	Entity Type	Risk Score
Windows Defender reported a detection on a kernel object path $Path$ on $dest$	dest	system	50

Threat Objects

Field	Type
Path	file_path

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1