Detectioninformationaltest
Windows Defender Malware Detection History Deletion
Windows Defender logs when the history of detected infections is deleted.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
Windowswindefend
ProductWindows← raw: windows
Servicewindefend← raw: windefend
Detection Logic
Detection Logic1 selector
detection:
selection:
EventID: 1013 # The antimalware platform deleted history of malware and other potentially unwanted software.
condition: selectionFalse Positives
Deletion of Defender malware detections history for legitimate reasons
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
2afe6582-e149-11ea-87d0-0242ac130003
Status
test
Level
informational
Type
Detection
Created
Thu Aug 13
Modified
Fri Nov 24
Author
Path
rules/windows/builtin/windefend/win_defender_history_delete.yml
Raw Tags
attack.defense-evasion