<span class="pill kill-chain">_time</span>
<span class="pill kill-chain">Action_ID</span>
<span class="pill kill-chain">Action_Name</span>
<span class="pill kill-chain">ActivityID</span>
<span class="pill kill-chain">Additional_Actions_ID</span>
<span class="pill kill-chain">Additional_Actions_String</span>
<span class="pill kill-chain">Category_ID</span>
<span class="pill kill-chain">Category_Name</span>
<span class="pill kill-chain">Channel</span>
<span class="pill kill-chain">Computer</span>
<span class="pill kill-chain">Detection_ID</span>
<span class="pill kill-chain">Detection_Time</span>
<span class="pill kill-chain">Detection_User</span>
<span class="pill kill-chain">dvc</span>
<span class="pill kill-chain">dvc_nt_host</span>
<span class="pill kill-chain">Engine_Version</span>
<span class="pill kill-chain">Error_Code</span>
<span class="pill kill-chain">Error_Description</span>
<span class="pill kill-chain">event_id</span>
<span class="pill kill-chain">EventCode</span>
<span class="pill kill-chain">EventData_Xml</span>
<span class="pill kill-chain">EventID</span>
<span class="pill kill-chain">EventRecordID</span>
<span class="pill kill-chain">eventtype</span>
<span class="pill kill-chain">Execution_ID</span>
<span class="pill kill-chain">Execution_Name</span>
<span class="pill kill-chain">FWLink</span>
<span class="pill kill-chain">Guid</span>
<span class="pill kill-chain">id</span>
<span class="pill kill-chain">Keywords</span>
<span class="pill kill-chain">Level</span>
<span class="pill kill-chain">Name</span>
<span class="pill kill-chain">Opcode</span>
<span class="pill kill-chain">Origin_ID</span>
<span class="pill kill-chain">Origin_Name</span>
<span class="pill kill-chain">Path</span>
<span class="pill kill-chain">Post_Clean_Status</span>
<span class="pill kill-chain">Pre_Execution_Status</span>
<span class="pill kill-chain">Process_Name</span>
<span class="pill kill-chain">ProcessID</span>
<span class="pill kill-chain">Product_Name</span>
<span class="pill kill-chain">Product_Version</span>
<span class="pill kill-chain">RecordNumber</span>
<span class="pill kill-chain">Security_intelligence_Version</span>
<span class="pill kill-chain">severity</span>
<span class="pill kill-chain">Severity_ID</span>
<span class="pill kill-chain">severity_id</span>
<span class="pill kill-chain">Severity_Name</span>
<span class="pill kill-chain">signature_id</span>
<span class="pill kill-chain">Source_ID</span>
<span class="pill kill-chain">Source_Name</span>
<span class="pill kill-chain">splunk_server</span>
<span class="pill kill-chain">State</span>
<span class="pill kill-chain">Status_Code</span>
<span class="pill kill-chain">System_Props_Xml</span>
<span class="pill kill-chain">SystemTime</span>
<span class="pill kill-chain">tag</span>
<span class="pill kill-chain">Task</span>
<span class="pill kill-chain">TaskCategory</span>
<span class="pill kill-chain">ThreadID</span>
<span class="pill kill-chain">Threat_ID</span>
<span class="pill kill-chain">Threat_Name</span>
<span class="pill kill-chain">Type_ID</span>
<span class="pill kill-chain">Type_Name</span>
<span class="pill kill-chain">user_id</span>
<span class="pill kill-chain">UserID</span>
<span class="pill kill-chain">vendor_product</span>
<span class="pill kill-chain">Version</span>
</div>
Data Source: Windows Event Log Defender 1116
Description
Logs an event when a Windows Defender detects a malware or potentially unwanted software.
Details
| Property | Value |
|---|---|
| Source | WinEventLog:Microsoft-Windows-Windows Defender/Operational |
| Sourcetype | XmlWinEventLog |
| Separator | EventCode |
Related Detections
| Name | Technique | Type |
|---|---|---|
| Windows Defender Threat Detected on Kernel Object Path | Exploitation for Privilege Escalation, Exploitation for Stealth | TTP |
Supported Apps
- Splunk Add-on for Microsoft Windows (version 11.0.2)
Event Fields
Fields
Example Log
1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1116</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-08-14T16:03:24.4014137Z'/><EventRecordID>1799</EventRecordID><Correlation ActivityID='{262bcfb4-42e2-4bf5-a88f-74aeb3ef10fc}'/><Execution ProcessID='380' ThreadID='8024'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>EC2AMAZ-FKEOM7G</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.26070.9</Data><Data Name='Detection ID'>{8D3B4441-6828-4720-8030-B059CF1D35D5}</Data><Data Name='Detection Time'>2026-08-14T16:03:24.393Z</Data><Data Name='Unused'></Data><Data Name='Unused2'></Data><Data Name='Threat ID'>2147519003</Data><Data Name='Threat Name'>Virus:DOS/EICAR_Test_File</Data><Data Name='Severity ID'>5</Data><Data Name='Severity Name'>Severe</Data><Data Name='Category ID'>42</Data><Data Name='Category Name'>Virus</Data><Data Name='FWLink'>https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0</Data><Data Name='Status Code'>1</Data><Data Name='Status Description'></Data><Data Name='State'>1</Data><Data Name='Source ID'>1</Data><Data Name='Source Name'>User</Data><Data Name='Process Name'>Unknown</Data><Data Name='Detection User'>EC2AMAZ-FKEOM7G\Administrator</Data><Data Name='Unused3'></Data><Data Name='Path'>containerfile:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN; file:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN->eicar.com</Data><Data Name='Origin ID'>2</Data><Data Name='Origin Name'>Network share</Data><Data Name='Execution ID'>0</Data><Data Name='Execution Name'>Unknown</Data><Data Name='Type ID'>0</Data><Data Name='Type Name'>Concrete</Data><Data Name='Pre Execution Status'>0</Data><Data Name='Action ID'>9</Data><Data Name='Action Name'>Not Applicable</Data><Data Name='Unused4'></Data><Data Name='Error Code'>0x00000000</Data><Data Name='Error Description'>The operation completed successfully. </Data><Data Name='Unused5'></Data><Data Name='Post Clean Status'>0</Data><Data Name='Additional Actions ID'>0</Data><Data Name='Additional Actions String'>No additional actions required</Data><Data Name='Remediation User'></Data><Data Name='Unused6'></Data><Data Name='Security intelligence Version'>AV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0</Data><Data Name='Engine Version'>AM: 1.1.26070.7, NIS: 1.1.26070.7</Data></EventData></Event>
Source: GitHub | Version: 1