GitHub Repo

Data Source: Windows Event Log Defender 1125

Date: 2025-07-10

ID: 0cddda76-6fd8-4fb6-9026-f23a2761c95d

Author: Bhavin Patel, Splunk

Description

Data source object for Windows Event Log Defender 1125

Details

Property Value
Source XmlWinEventLog:Security
Sourcetype XmlWinEventLog
Separator EventCode
Name ▲▼ Technique ▲▼ Type ▲▼
Windows Defender ASR Audit Events Command and Scripting Interpreter, Spearphishing Attachment, Spearphishing Link Anomaly
Windows Defender ASR Rules Stacking Spearphishing Attachment, Spearphishing Link, Command and Scripting Interpreter Hunting

Supported Apps

Event Fields

+ Fields 
  <span class="pill kill-chain">_time</span>
  
</div>

Example Log

1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event>

Source: GitHub | Version: 2