Windows Defender Operational Log

Location

Description

Windows Defender antivirus operational log recording threat detections (Event 1116), remediation actions (Event 1117), real-time protection state changes (Event 5001/5004), and exclusion modifications.

Forensic Value

Defender logs reveal what the attacker deployed that triggered detection and what they did to evade it. Event 1116 contains the detected threat name, file path, and process that accessed it. Event 5001 timestamps when real-time protection was disabled, marking the window of unmonitored activity. Exclusion additions in the log show which paths or processes the attacker whitelisted to avoid future detection.

Tools Required