Defender detections and history

Location & availability

Microsoft-Windows-Windows Defender/Operational and applicable Protection History records

Coverage depends on the active security product, configuration, exclusions and retention. Do not alter protection settings during examination.

Fields to examine

• Threat name and affected resource path where recorded.
• Detection and action events with timestamps.
• Action success/failure and engine/signature context when available.

What it can establish

• Support that Defender reported a detection or attempted a recorded action.

What it cannot prove

• Prove the player executed the file or cheated.
• Treat every detection name as a conclusive independent technical analysis.

Use it in a screenshare

1. Export relevant events and preserve the displayed action context. Do not restore quarantined files on the player’s live machine.
2. Separate detection time from the original file’s acquisition or execution time. Check whether remediation succeeded.
3. Correlate the affected resource with a retained hash, download record and run artifact. Record the possibility of false positives or unwanted-program classifications.

Worked example

Defender quarantined an archive during download. This supports detection and remediation context; it may specifically mean the payload was prevented from running. Do not convert the detection into a claim of successful execution.

Cross-check the finding

• Browser download records →Support a recorded transfer attempt and, when recorded, its completion state.
• Prefetch →Support execution of an associated executable within the retained history.
• Security event 4688 →Support process creation recorded by the audited host.

Sources

• Microsoft — Defender Antivirus events ↗