Detectionhightest

Win Defender Restored Quarantine File

Detects the restoration of files from the defender quarantine

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Tue Dec 06bc92ca75-cd42-4d61-9a37-9d5aa259c88bwindows

Log Source

Windowswindefend

ProductWindows← raw: windows

Servicewindefend← raw: windefend

Detection Logic

detection:
    selection:
        EventID: 1009 # The antimalware platform restored an item from quarantine.
    condition: selection

False Positives

Legitimate administrator activity restoring a file

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

bc92ca75-cd42-4d61-9a37-9d5aa259c88b

Status

test

Level

high

Type

Detection

Created

Tue Dec 06

Author

Path

rules/windows/builtin/windefend/win_defender_restored_quarantine_file.yml

Raw Tags

attack.defense-evasionattack.t1562.001