Windows Defender Threat Detected

Title: Windows Defender Threat Detected
Status: stable
Description:Detects actions taken by Windows Defender malware detection engines
References:
  -https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
Author: Ján Trenčanský
Date: 2020-07-28
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• product: windows
• service: windefend

Detection:
  selection:
    EventID:
      -'1006'
      -'1015'
      -'1116'
      -'1117'

  condition:selection
Falsepositives:
  -Unlikely
Level: high