Retrieving Windows Defender Exploit Guard Windows Event logs with PowerShell

Posted onAuthorAlex Verboon5 Comments

Most of the features included in Windows Defender Exploit Guard can be enabled in audit or block mode. The impact can then be analyzed either by looking at the corresponding Windows Event log entries or through advanced hunting queries in Windows Defender ATP.

Today, I’ll share a script I recently wrote to quickly pull Windows Defender Exploit Guard related events from the Windows Event log. Anytime soon I will share some Kusto queries for the advanced hunting method through MDATP.

Note that the current version of the script only pulls events for Controlled Folder Access Network Protection and Attack Surface Rules. I plan to exten the script to also include Exploit Protection rules anytime soon. Needs a bit of extra effort since these events are scattered over multiple event log sources.


Related posts:

  1. Windows Defender, More than just Antivirus – Part 2
  2. Retrieving Windows Defender ATP query API data with PowerShell
  3. Testing Windows Defender MAPS Connectivity with PowerShell
  4. How to generate a monthly Defender ATP Threat and Vulnerability Report
  5. Check Windows Defender ATP Client Status with PowerShell

5 Replies to “Retrieving Windows Defender Exploit Guard Windows Event logs with PowerShell”

  3. Pingback: Windows Defender, More than just Antivirus – Part 2 – Anything about IT
  4. Pingback: Defense in depth on an example: Office Macro Protection - Workplace Ninja's
  5. Pingback: Deploying Defender ASR – Block persistence through WMI event subscription – Anything about IT

Leave a Reply