src_6df1fb5096a2991dbd
- Source-provided label
- Not reported
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Dec 14, 2023 05:13 UTC
- Retrieved
- Oct 08, 2026 03:45 UTC
Reverse, Reveal, Recover: Windows Defender Quarantine Forensics
Max Groot & Erik Schamper TL;DR Introduction During incident response engagements we often encounter antivirus applications that have rightfully triggered on malicious software that was deployed by threat actors. Most commonly we encounter this for Windows Defender, the antivirus solution that is shipped by default with Microsoft Windows. Windows Defender places malicious files in quarantine … Con
Reference details
- Source category
- Research & news
- Report title
Reverse, Reveal, Recover: Windows Defender Quarantine Forensics- First reported
- Dec 14, 2023 05:13 UTC
- Last reported
- Dec 14, 2023 05:13 UTC
- Catalog updated
- Oct 08, 2026 03:45 UTC
- Record ID
a82b0c2fd08dcdaa2d4dd4a02dd05d9a8b6713ea7c9574e56d890ad4c8a1c1ab
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Review source update dates and status
- src_6df1fb5096a2991dbdCollection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.