Defender Event ID 1117 — Microsoft Defender took action on malware

Microsoft Defender Antivirus took an action (Quarantine, Remove, Block, Clean, or Allow) on a previously detected threat. Pairs with the 1116 detection event.

Why event 1117 matters

1117 confirms the outcome of remediation. Action=Allowed on a real threat — or a failed clean-up — means the malware likely persists. Attackers may add exclusions (5007) so Defender allows their payload instead of quarantining it.

How to detect it

Alert when Action=Allowed for non-test threats. Flag threats detected (1116) with no successful 1117. Track hosts with repeated failed remediations for manual IR.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

title: Defender Threat Allowed Or Remediation Failed
status: experimental
logsource:
  product: windows
  service: windefend
detection:
  sel:
    EventID: 1117
    Action: 'Allowed'
  condition: sel
level: high

Event
| where EventLog == "Microsoft-Windows-Windows Defender/Operational" and EventID == 1117   // Microsoft Defender took action on malware
// EventData holds: Threat Name, Action, Path, Process Name
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Microsoft-Windows-Windows Defender/Operational" EventCode=1117
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Microsoft Defender took action on malware — add EventData fields: Threat Name, Action, Path, Process Name`

References

• learn.microsoft.com

Related Threat Detection events