Microsoft-Windows-Windows Defender/OperationalMicrosoft Defender Antivirus

1116 · The antimalware platform detected malware or other potentially unwanted software

Microsoft Defender Antivirus detected malware or potentially unwanted software. Records the threat name, severity, path, detection source, user and process.

01Fields in the event

Name
ID
Severity
Category
Path
Detection Origin
Detection Type
Detection Source
User
Process Name
Signature Version
Engine Version

02How to use it

Path and Process Name locate the file and the process involved; compare the time with file system timestamps and process events. Check the following 1117 to see what action was taken.

03Caveats

A detection names a signature match, not proof of execution or of who placed the file. Field names are the labels listed by Microsoft.

05Sources

Microsoft Learn — Microsoft Defender Antivirus event IDs and error codes checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.