Microsoft Defender logs and quarantine

What it is

Microsoft Defender Antivirus (formerly Windows Defender) is the built-in antimalware engine of Windows 8 and later. Besides its event log, it keeps plain-text support logs (MPLog), per-detection DetectionHistory files and an encrypted quarantine that still holds the original malware. Because Defender is present on nearly every Windows host, these files often tell you what the attacker dropped, when, from which process, and whether they tried to switch the product off first.

Location

All of these folders are restricted to administrators or SYSTEM.

What it proves

• Presence and execution of malware: 1116/1117 name the threat, the file path, the process that touched it and the user. A detection with source AMSI points to script content, often PowerShell.
• File existence and hashes: MPLog lines record scanned files with SHA-1/SHA-256 and processes with their image names, even for files Defender did not flag.
• The sample itself: the quarantine stores the full original file with its timestamps, security descriptor and Zone.Identifier stream.
• Defense evasion: 5001, 5007, 5010/5012, 5013 and new exclusion keys show real-time protection being turned off or paths being excluded.
• It does not prove that a detected file ran: many detections happen on write or on download. Check the detection source and correlate with execution artifacts.

Key fields

1116/1117 fields: Threat Name, Severity Name, Category Name, Path, Detection Origin, Detection Source (Real-Time, User, System, AMSI, IOAV...), Detection User, Process Name, Action Name, signature and engine versions. In MPLog, look for ProcessImageName lines (process name, number of files scanned, estimated impact), SDN lines (file path with SHA-1 and SHA-256) and DETECTIONEVENT lines. DetectionHistory files hold the threat name, file path, user, process, file size and MD5/SHA-1/SHA-256.

Timestamps

Retention and clearing

• The Operational log rolls over at its maximum size; on a noisy host it can cover only a few weeks.
• MPLog files are rotated by Defender, so older activity disappears over time; collect them early.
• Quarantined items are removed after a retention period (configurable by policy) or by a user or attacker action, which produces 1011; clearing detection history produces 1013.
• Classic tampering: Set-MpPreference -DisableRealtimeMonitoring $true, Add-MpPreference -ExclusionPath, MpCmdRun.exe -RemoveDefinitions -All, stopping the service or editing policy keys. When tamper protection is on, it blocks many of these and logs 5013. The attempts often survive in PowerShell history and 5007 events even when other traces were removed.

Collection

• KAPE targets: WindowsDefender (Operational log, Support folders, MpCmdRun.log, DetectionHistory, Quarantine, Detections.log) and WinDefendDetectionHist (DetectionHistory only).
• Velociraptor (Windows.Triage.Targets): WindowsDefender, WinDefendDetectionHist.
• Built-in (elevated): copy the folders with backup semantics, export the log and query the current state.

robocopy "C:\ProgramData\Microsoft\Windows Defender" E:\case\Defender /E /COPY:DAT /DCOPY:T /B /XD "Definition Updates"
wevtutil epl "Microsoft-Windows-Windows Defender/Operational" E:\case\Defender-Operational.evtx
Get-MpThreatDetection | Export-Csv E:\case\mpthreatdetection.csv -NoTypeInformation
Get-MpPreference | Select-Object Exclusion*, DisableRealtimeMonitoring
reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s

Quarantine files are still live malware once decrypted; handle them in an isolated lab.

Parsing tools

• EvtxECmd (Eric Zimmerman): maps for Defender events including 1116, 1117, 5001 and 5007.
• mplog_parser (Intrinsec, open source): turns MPLog-* files into CSV.
• DHParser (open source): parses DetectionHistory files to JSON.
• Dissect (Fox-IT, open source): defender.quarantine lists quarantine entries, defender.recover decrypts the files, defender.mplog and defender.exclusions parse logs and exclusions.
• Velociraptor: community artifacts Windows.Applications.DefenderDHParser and Windows.Applications.DefenderHistory on the artifact exchange.

Investigation tips

• Build a detection timeline from 1116/1117 first, then enrich each hit with the DetectionHistory file and the quarantine entry for the same threat.
• Recover the quarantined sample and read its Zone.Identifier stream: the Mark of the Web gives the download URL (see Zone.Identifier).
• Treat any 5001, 5010, 5012 or 5007 event that adds an exclusion around the intrusion window as anti-forensics, and find the command that caused it in PowerShell logs.
• Search MPLog for tool names and unusual paths even when nothing was detected: SDN and ProcessImageName lines can prove a file existed or a process ran.
• Match SHA-1 values from MPLog or DetectionHistory with Amcache and with TargetAppId in WER reports.
• A detection with action "Allow" or a failed action (1008/1118) means the malware may still be active.