Win Defender Restored Quarantine File

Title: Win Defender Restored Quarantine File
Status: test
Description:Detects the restoration of files from the defender quarantine
References:
  -https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-06
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• service: windefend

Detection:
  selection:
    EventID: '1009'
  condition:selection
Falsepositives:
  -Legitimate administrator activity restoring a file
Level: high