1116 Defender log · Threat Detection high severity low volume

Defender Event ID 1116 — Microsoft Defender detected malware or PUA

Microsoft Defender Antivirus detected malware or a potentially unwanted application (PUA). The event records the Threat Name, Severity, file Path, the Process involved and the Detection User.

Why event 1116 matters

Fires when Defender's engine matches known-bad content or behaviour. A 1116 with no following 1117 (action taken) can mean remediation failed and the threat is still live. Attackers frequently blind Defender (5001/5007) before delivery, so a 1116 burst across hosts often signals an active commodity-loader or ransomware precursor campaign.

How to detect it

Alert on Severity=Severe/High. Correlate a 1116 with no matching 1117 within a few minutes (failed clean-up). Prioritise detections in user-writable paths (AppData, Temp, Downloads). Baseline EICAR/test noise, and enrich Threat Name against threat intel.

Log source
Microsoft-Windows-Windows Defender/Operational
On by default where Microsoft Defender Antivirus is active; ensure the Operational channel is collected.
Fields to pivot on
Threat NameSeverityPathProcess NameDetection User

MITRE ATT&CK mapping

Tactic Technique
Execution Malicious File (T1204.002)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Defender High-Severity Malware Detection
status: experimental
logsource:
  product: windows
  service: windefend
detection:
  sel:
    EventID: 1116
    Severity:
      - 'Severe'
      - 'High'
  condition: sel
level: high
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Windows Defender/Operational" and EventID == 1116   // Microsoft Defender detected malware or PUA
// EventData holds: Threat Name, Severity, Path, Process Name, Detection User
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Windows Defender/Operational" EventCode=1116
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Microsoft Defender detected malware or PUA — add EventData fields: Threat Name, Severity, Path, Process Name`
Hunt event 1116 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

References

Related Threat Detection events

1117 Microsoft Defender took action on malware

Frequently asked questions

What is Defender Event ID 1116?

Microsoft Defender detected malware or PUA. Microsoft Defender Antivirus detected malware or a potentially unwanted application (PUA). The event records the Threat Name, Severity, file Path, the Process involved and the Detection User.

Which log records event 1116?

Event 1116 is written to the Microsoft-Windows-Windows Defender/Operational channel by Microsoft-Windows-Windows Defender. On by default where Microsoft Defender Antivirus is active; ensure the Operational channel is collected.

What MITRE ATT&CK techniques map to event 1116?

Event 1116 is associated with: Malicious File (T1204.002).

How do you detect activity around event 1116?

Alert on Severity=Severe/High. Correlate a 1116 with no matching 1117 within a few minutes (failed clean-up). Prioritise detections in user-writable paths (AppData, Temp, Downloads). Baseline EICAR/test noise, and enrich Threat Name against threat intel.