Data Source: Windows Event Log Defender 1129

Created: 2024-05-22

Last Updated: 2026-10-14

ID: 0572e119-a48a-4c70-bc58-90e453edacd2

Author: Patrick Bareiss, Splunk

Description

Logs an event when a user overrides a security policy set by an Attack Surface Reduction rule in Microsoft Defender.

Details

Property	Value
Source	`WinEventLog:Microsoft-Windows-Windows Defender/Operational`
Sourcetype	`XmlWinEventLog`
Separator	EventCode

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Defender ASR Block Events	Command and Scripting Interpreter, Spearphishing Attachment, Spearphishing Link	Anomaly
Windows Defender ASR Rules Stacking	Command and Scripting Interpreter, Spearphishing Attachment, Spearphishing Link	Hunting

Supported Apps

Splunk Add-on for Microsoft Windows (version 11.0.3)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">category</span>
  
  <span class="pill kill-chain">ComputerName</span>
  
  <span class="pill kill-chain">date</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventType</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">file_name</span>
  
  <span class="pill kill-chain">file_path</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">ID</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">LogName</span>
  
  <span class="pill kill-chain">Message</span>
  
  <span class="pill kill-chain">OpCode</span>
  
  <span class="pill kill-chain">Path</span>
  
  <span class="pill kill-chain">Process_Name</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">Sid</span>
  
  <span class="pill kill-chain">SidType</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">TaskCategory</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">Type</span>
  
  <span class="pill kill-chain">User</span>
  
  <span class="pill kill-chain">user</span>
  
</div>

Example Log

 111/17/2023 05:23:37 PM
 2LogName=Microsoft-Windows-Windows Defender/Operational
 3EventCode=1129
 4EventType=4
 5ComputerName=researchvmhaa
 6User=NOT_TRANSLATED
 7Sid=S-1-5-18
 8SidType=0
 9SourceName=Microsoft-Windows-Windows Defender
10Type=Information
11RecordNumber=2360
12Keywords=None
13TaskCategory=None
14OpCode=Info
15Message=A user has allowed a blocked Microsoft Defender Exploit Guard operation.
16     ID: D1E49AAC-8F56-4280-B9BA-993A6D77406C
17     User: NT AUTHORITY\SYSTEM
18     Path: C:\Windows\System32\cmd.exe
19     Process Name: C:\Windows\PSEXESVC.exe
20     Involved File:

Source: GitHub | Version: 5