Defender Event ID 1116: defender detected malware
What Defender Event ID 1116 (defender detected malware) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Defender Event ID 1116 means Microsoft Defender Antivirus detected malware or unwanted software. It does not say whether the threat was removed: that comes in Event ID 1117 (action taken) or 1118 and 1119 (action failed). So the triage question for every 1116 is twofold: what was it, and is it still there?
The fields that matter
| Field | What it tells you |
|---|---|
| Name | The threat name, for example Trojan:Win32/..., HackTool:Win32/Mimikatz or Behavior:Win32/.... The prefix tells you the category. |
| Severity / Category | Defender's own rating and type (Trojan, Tool, PUA and so on). |
| Path | Where it was found. A file:_ prefix is a file, process:_ a running process. |
| Detection Origin / Type | Local machine, network share or download, and whether it was a concrete file or a behaviour. |
| Detection User / Process Name | Who was logged on and which process touched the file. |
What is normal
An occasional detection in the Downloads folder or a browser cache, followed by a successful 1117 quarantine, on a user's laptop.
When Defender Event ID 1116 is suspicious
HackTooldetections such as Mimikatz, Rubeus or Cobalt Strike: someone ran attacker tooling, so treat the host as compromised.Behavior:detections: Defender saw malicious activity, not just a file.- No 1117 afterwards, or a 1118 or 1119: the threat may still be active.
- The same threat detected again and again on one host: it is being recreated by something Defender has not found.
- Detections on a server or domain controller, or in
C:\Windows\TemporProgramData.
Common false positive: Admin tools such as password recovery utilities, network scanners and remote access tools are often flagged as PUA or HackTool. Confirm the user and purpose before closing it.
Find Defender Event ID 1116 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1116; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
Event
| where TimeGenerated > ago(7d) and EventLog == "Microsoft-Windows-Windows Defender/Operational" and EventID == 1116
| project TimeGenerated, Computer, RenderedDescription, EventData
| order by TimeGenerated descRelated events
- Defender Event ID 1117: Defender took action on malware
- Defender Event ID 5001: Defender real-time protection disabled
- Sysmon Event ID 1: process creation
- Event ID 4688: New process created
FAQ
What is the difference between Defender Event ID 1116 and 1117?
1116 is the detection; 1117 is the action taken (quarantine, remove, allow). Always read them together.
How do I check a detected file's hash?
Get the hash from Defender's history or the file itself and look it up in VirusTotal or MalwareBazaar. IOC Triage checks a hash against both with a right-click.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.