← Back to SOC feed Coverage →

Antivirus detections (1)

kql MEDIUM Azure-Sentinel
AlertEvidence
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-24T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may attempt to evade detection by suppressing or modifying antivirus alerts, which could indicate tampering with system defenses. SOC teams should proactively hunt for unusual patterns in antivirus detection events to identify potential evasion tactics and uncover hidden malicious activity in their Azure Sentinel environment.

KQL Query

// Query #2:
//    This query select only machines where more than 1 malware family was detected.
//    Such behavior is usually indicative that some malware was active on the machine
// Implementation details:
//    This query looks for alerts on Windows Defender Antivirus detections.
//    For most purposes it is probably better to query on the events themselves (see query #1).
//    However, this query might still be useful sometimes (e.g. to quickly parse the family name).
AlertInfo | join AlertEvidence on AlertId
| where Title contains "Defender AV detected"
| parse Title with *"'"FamilyName"'"*
| summarize FamilyCount=dcount(FamilyName), Families=makeset(FamilyName), Titles=makeset(Title) by DeviceName, DeviceId, bin(Timestamp, 1d)
| where FamilyCount > 1
| limit 100

Analytic Rule Definition

id: 05250700-5123-45be-826d-dd14c623fade
name: Antivirus detections (1)
description: |
  Query for Microsoft Defender Antivirus detections.
  Query #1: Query for Antivirus detection events.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
query: |
  // Query #2:
  //    This query select only machines where more than 1 malware family was detected.
  //    Such behavior is usually indicative that some malware was active on the machine
  // Implementation details:
  //    This query looks for alerts on Windows Defender Antivirus detections.
  //    For most purposes it is probably better to query on the events themselves (see query #1).
  //    However, this query might still be useful sometimes (e.g. to quickly parse the family name).
  AlertInfo | join AlertEvidence on AlertId
  | where Title contains "Defender AV detected"
  | parse Title with *"'"FamilyName"'"*
  | summarize FamilyCount=dcount(FamilyName), Families=makeset(FamilyName), Titles=makeset(Title) by DeviceName, DeviceId, bin(Timestamp, 1d)
  | where FamilyCount > 1
  | limit 100

Required Data Sources

Sentinel TableNotes
AlertEvidenceEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Protection events/Antivirus detections (1).yaml