Tools · Windows security and Event Logs · 21 / 27
Microsoft Defender event IDs: 1116 detections, 5001 protection off, 5007 config changes
Know the Defender Operational log events that matter for detection and tampering, and query them across a lab machine.
The core events
In Microsoft-Windows-Windows Defender/Operational: 1116 malware or potentially unwanted software detected, 1117 action taken, 1118 and 1119 action failed, 1006 and 1007 for older scan-based detections, 5001 real-time protection disabled, 5004 real-time protection configuration changed, 5007 platform configuration changed (including exclusions), 5010 and 5012 scanning disabled, and 2001 or 2003 signature update failures.
1116 without a successful 1117 means the threat may still be present.
Why 5001 and 5007 matter
Attackers who gain administrator rights often try to weaken Defender before running their tools. 5001 records real-time protection turned off. 5007 records registry-level configuration changes, including new exclusions, with old and new values. Either on a machine outside a change window is suspicious.
Tamper protection blocks most of these changes, and Defender logs the blocked attempt.
Lab: produce and query the events
On a lab VM with tamper protection off, add a path exclusion, temporarily disable real-time monitoring, re-enable it, and drop the EICAR test file. Query the Operational log for 1116, 1117, 5001, and 5007 and read the old and new values in 5007.
Then re-enable tamper protection and try again; observe that the change is refused.
Add-MpPreference -ExclusionPath 'C:\LabExcluded'
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableRealtimeMonitoring $false
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1116,1117,5001,5007; StartTime=(Get-Date).AddMinutes(-15)} |
Format-List TimeCreated, Id, Message
Remove-MpPreference -ExclusionPath 'C:\LabExcluded'Alerts to build
Alert on 5001 and on 5007 changes to exclusion keys from any machine. Alert on 1116 without a matching 1117 success. Track 2001 signature update failures as a health metric.
Forward this log centrally like the Security log. Defender events are often the first sign of an intrusion.
Diagram
Defender events by meaning
Detection, action, and tampering.
- 1116
Threat detected.
- 1117 / 1118
Action succeeded or failed.
- 5001
Real-time protection disabled.
- 5007
Configuration changed, including exclusions.
- 2001
Signature update failed.
Check yourself
1. Which event shows real-time protection was turned off?
2. Which event records a new exclusion being added?
3. A 1116 appears with no 1117 success. What does that suggest?