<span class="pill kill-chain">_time</span>
<span class="pill kill-chain">ActivityID</span>
<span class="pill kill-chain">category</span>
<span class="pill kill-chain">Channel</span>
<span class="pill kill-chain">Computer</span>
<span class="pill kill-chain">ComputerName</span>
<span class="pill kill-chain">date</span>
<span class="pill kill-chain">date_hour</span>
<span class="pill kill-chain">date_mday</span>
<span class="pill kill-chain">date_minute</span>
<span class="pill kill-chain">date_month</span>
<span class="pill kill-chain">date_second</span>
<span class="pill kill-chain">date_wday</span>
<span class="pill kill-chain">date_year</span>
<span class="pill kill-chain">date_zone</span>
<span class="pill kill-chain">dest</span>
<span class="pill kill-chain">Detection_Time</span>
<span class="pill kill-chain">Detection_time</span>
<span class="pill kill-chain">dvc</span>
<span class="pill kill-chain">dvc_nt_host</span>
<span class="pill kill-chain">Engine_Version</span>
<span class="pill kill-chain">event_id</span>
<span class="pill kill-chain">EventCode</span>
<span class="pill kill-chain">EventData_Xml</span>
<span class="pill kill-chain">EventID</span>
<span class="pill kill-chain">EventRecordID</span>
<span class="pill kill-chain">EventType</span>
<span class="pill kill-chain">eventtype</span>
<span class="pill kill-chain">file_name</span>
<span class="pill kill-chain">file_path</span>
<span class="pill kill-chain">Guid</span>
<span class="pill kill-chain">host</span>
<span class="pill kill-chain">ID</span>
<span class="pill kill-chain">id</span>
<span class="pill kill-chain">index</span>
<span class="pill kill-chain">Inheritance_Flags</span>
<span class="pill kill-chain">Inhertiance_Flags</span>
<span class="pill kill-chain">Involved_File</span>
<span class="pill kill-chain">Keywords</span>
<span class="pill kill-chain">Level</span>
<span class="pill kill-chain">linecount</span>
<span class="pill kill-chain">LogName</span>
<span class="pill kill-chain">Message</span>
<span class="pill kill-chain">meta</span>
<span class="pill kill-chain">Name</span>
<span class="pill kill-chain">New_Value</span>
<span class="pill kill-chain">New_value</span>
<span class="pill kill-chain">Old_Value</span>
<span class="pill kill-chain">Old_value</span>
<span class="pill kill-chain">OpCode</span>
<span class="pill kill-chain">Opcode</span>
<span class="pill kill-chain">Parent_Commandline</span>
<span class="pill kill-chain">Path</span>
<span class="pill kill-chain">Process_Name</span>
<span class="pill kill-chain">ProcessID</span>
<span class="pill kill-chain">Product_Name</span>
<span class="pill kill-chain">Product_Version</span>
<span class="pill kill-chain">product_version</span>
<span class="pill kill-chain">punct</span>
<span class="pill kill-chain">RecordNumber</span>
<span class="pill kill-chain">RuleType</span>
<span class="pill kill-chain">Security_intelligence_Version</span>
<span class="pill kill-chain">severity</span>
<span class="pill kill-chain">severity_id</span>
<span class="pill kill-chain">Sid</span>
<span class="pill kill-chain">SidType</span>
<span class="pill kill-chain">signature</span>
<span class="pill kill-chain">signature_id</span>
<span class="pill kill-chain">source</span>
<span class="pill kill-chain">sourcetype</span>
<span class="pill kill-chain">splunk_server</span>
<span class="pill kill-chain">System_Props_Xml</span>
<span class="pill kill-chain">SystemTime</span>
<span class="pill kill-chain">tag</span>
<span class="pill kill-chain">tag::eventtype</span>
<span class="pill kill-chain">Target_Commandline</span>
<span class="pill kill-chain">Task</span>
<span class="pill kill-chain">TaskCategory</span>
<span class="pill kill-chain">ThreadID</span>
<span class="pill kill-chain">timeendpos</span>
<span class="pill kill-chain">timestamp</span>
<span class="pill kill-chain">timestartpos</span>
<span class="pill kill-chain">Type</span>
<span class="pill kill-chain">User</span>
<span class="pill kill-chain">user</span>
<span class="pill kill-chain">user_id</span>
<span class="pill kill-chain">UserID</span>
<span class="pill kill-chain">vendor_product</span>
<span class="pill kill-chain">Version</span>
</div>
Data Source: Windows Event Log Defender 5007
Description
Logs an event when Windows Defender antimalware settings are modified.
Details
| Property | Value |
|---|---|
| Source | WinEventLog:Microsoft-Windows-Windows Defender/Operational |
| Sourcetype | XmlWinEventLog |
| Separator | EventCode |
Related Detections
Supported Apps
- Splunk Add-on for Microsoft Windows (version 11.0.3)
Event Fields
Fields
Example Log
1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>5007</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-27T18:24:38.0404379Z'/><EventRecordID>3745</EventRecordID><Correlation/><Execution ProcessID='3512' ThreadID='5780'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Old Value'>HKLM\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c = 0x2</Data><Data Name='New Value'>HKLM\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c = 0x0</Data></EventData></Event>
Source: GitHub | Version: 5