_raw:
10/29/2025 07:02:34.488 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=202
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.545.0
 	Antispyware security intelligence version: 1.439.545.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-29T10:59:14Z
 	Antispyware security intelligence creation time: 2025-10-29T10:59:13Z
 	Last quick scan start time: 2025-10-29T06:00:46Z
 	Last quick scan end time: 2025-10-29T06:01:12Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 07:02:16.354 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=35
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1919
 	Antispyware security intelligence age: 1919
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
10/29/2025 07:02:06.758 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=203
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/29/2025 07:02:06.446 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=202
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.545.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\3c6bca3d3b171a7d93336e1032f9719b637ee328
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/29/2025 11:02:06 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/29/2025 07:01:40.630 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=200
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/29/2025 07:01:40.326 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=199
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.545.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\5466f3965d5aa2bc377929dc25c1e52f1b9d1b67
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/29/2025 11:01:40 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/29/2025 07:01:26.614 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=205
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.542.0
 	Antispyware security intelligence version: 1.439.542.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-29T08:54:54Z
 	Antispyware security intelligence creation time: 2025-10-29T08:54:53Z
 	Last quick scan start time: 1601-01-01T00:00:00Z
 	Last quick scan end time: 1601-01-01T00:00:00Z
 	Last quick scan source: 0
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 07:01:10.209 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=200
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/29/2025 07:01:09.907 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=199
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.545.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\8c2ffbf8e1c7f4c8bf0ebaea156753f9c865be5e
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/29/2025 11:01:09 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/29/2025 07:00:21.851 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t5-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=197
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/29/2025 07:00:21.567 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-socal-t5-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=196
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.545.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\f0086f6582e56322023a1fdaade879bcfbf3139e
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/29/2025 11:00:21 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/29/2025 06:59:52.634 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t5-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=204
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/29/2025 06:59:52.404 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-socal-t5-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=203
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.545.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\f05f4a6d2172295ec81c36a8b5a43ee1bea93f15
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/29/2025 10:59:52 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/29/2025 06:59:36.565 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=36
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1919
 	Antispyware security intelligence age: 1919
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=215
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "g8PyOLsBDr0j+ODt7Cd6WWxRs4qhVZOoRvOieSpDrAo="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "jbyFJqNzMt4ObUltGyejfnk7fMvrPXaM5aZ/TfB/fCs="


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=214
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=213
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=212
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=211
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=210
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=209
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=208
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=207
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=206
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=205
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=204
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=203
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=202
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=201
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
10/29/2025 06:59:21.881 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=200
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
10/29/2025 06:59:20.320 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=199
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.545.0
 	Antispyware security intelligence version: 1.439.545.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-29T10:59:14Z
 	Antispyware security intelligence creation time: 2025-10-29T10:59:13Z
 	Last quick scan start time: 2025-10-29T06:00:53Z
 	Last quick scan end time: 2025-10-29T06:01:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=216
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "g8PyOLsBDr0j+ODt7Cd6WWxRs4qhVZOoRvOieSpDrAo="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "jbyFJqNzMt4ObUltGyejfnk7fMvrPXaM5aZ/TfB/fCs="


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=215
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=214
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=213
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=212
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=211
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=210
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=209
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=208
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=207
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=206
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=205
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=204
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=203
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=202
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
10/29/2025 06:59:16.735 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=201
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
10/29/2025 06:59:14.016 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=200
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.545.0
 	Antispyware security intelligence version: 1.439.545.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-29T10:59:14Z
 	Antispyware security intelligence creation time: 2025-10-29T10:59:13Z
 	Last quick scan start time: 2025-10-29T06:00:34Z
 	Last quick scan end time: 2025-10-29T06:00:58Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:59:00.468 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t4-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1919
 	Antispyware security intelligence age: 1919
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:58:36.411 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-newengland-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1919
 	Antispyware security intelligence age: 1919
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:58:27.576 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=232
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.545.0
 	Antispyware security intelligence version: 1.439.545.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-29T10:59:14Z
 	Antispyware security intelligence creation time: 2025-10-29T10:59:13Z
 	Last quick scan start time: 2025-10-29T06:00:49Z
 	Last quick scan end time: 2025-10-29T06:01:13Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=231
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "nGYbYbObLPKEQr3MlznK1yZEEd77SbMra7/pwHnmwMc="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "HqEphHfIcknJVTShnhaZ9ewzyqrT4udt8NHcyBBVDi8="


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=230
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_SCC_VerifyPayloadSignature = 0xFFFFFFEF


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=229
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_SCC_AcceptedSources = 0x1


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=228
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=227
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=226
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=225
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=224
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=223
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_SCC_FeatureAvailable = 0x1


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=222
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=221
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=220
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=219
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=218
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=217
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=216
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=215
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=214
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
10/29/2025 06:58:25.294 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t3-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=213
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
10/29/2025 06:58:20.722 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-socal-t10-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=200
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.545.0
 	Antispyware security intelligence version: 1.439.545.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-29T10:59:14Z
 	Antispyware security intelligence creation time: 2025-10-29T10:59:13Z
 	Last quick scan start time: 2025-10-29T06:00:52Z
 	Last quick scan end time: 2025-10-29T06:01:19Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:57:57.218 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=40
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1919
 	Antispyware security intelligence age: 1919
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=217
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "g8PyOLsBDr0j+ODt7Cd6WWxRs4qhVZOoRvOieSpDrAo="
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "jbyFJqNzMt4ObUltGyejfnk7fMvrPXaM5aZ/TfB/fCs="


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=216
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnablePersistedScanV2 = 0x1


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=215
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_CoreSvc_ResMon_MemLimit = 0x191


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=214
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnableNoMetaStoreProcessInfoContainer = 0x1


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=213
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerMonitorInterval = 0x493E0


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=212
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdTimerInitalDelay = 0x493E2


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=211
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enforcement = 0x1


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=210
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdDisable1ds = 0x0


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=209
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableUpdateTriggerForSharedSigUpdates = 0x1


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=208
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableServiceRestartForSharedSigUpdates = 0x1


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=207
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_MdEnableCoreSvcRemediation = 0x1


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=206
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EcsConfigDownloadInterval = 0x3E


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=205
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MdDisableResController = 0x0


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=204
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Md1dsMaxMemorySize = 0x8


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=203
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_RtpEnableDefenderConfigMonitoring = 0x1


_raw:
10/29/2025 06:57:35.037 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=202
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_AnyApp_Enable = 0x2


_raw:
10/29/2025 06:57:33.942 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=201
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25090.3009
 	Engine version: 1.1.25090.3001
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.439.545.0
 	Antispyware security intelligence version: 1.439.545.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-10-29T10:59:14Z
 	Antispyware security intelligence creation time: 2025-10-29T10:59:13Z
 	Last quick scan start time: 2025-10-29T06:00:34Z
 	Last quick scan end time: 2025-10-29T06:01:03Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:57:21.453 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=36
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform Version: 4.18.2104.5
 	Engine Version: 1.1.17300.4
 	Network Realtime Inspection engine Version: 0.0.0.0
 	Antivirus security intelligence Version: 1.321.69.0
 	Antispyware security intelligence Version: 1.321.69.0
 	Network Realtime Inspection security intelligence Version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 1919
 	Antispyware security intelligence age: 1919
 	Last quick scan age: 4294967295
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 7/28/2020 7:44:27 PM
 	Antispyware security intelligence creation time: 7/28/2020 7:44:27 PM
 	Last quick scan start time: 1/1/1601 12:00:00 AM
 	Last quick scan end time: 1/1/1601 12:00:00 AM
 	Last quick scan source: 0
 	Last full scan start time: 1/1/1601 12:00:00 AM
 	Last full scan end time: 1/1/1601 12:00:00 AM
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
10/29/2025 06:57:06.403 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t5-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=200
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
10/29/2025 06:57:06.166 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2010
EventType=4
ComputerName=cptc11-regional-socal-t5-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=199
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus used cloud protection to get additional security intelligence.
 	Current security intelligence Version: 1.439.545.0
 	Security intelligence Type:
 	User: \
 	Current Engine Version: 1.1.25090.3001
 	Cloud protection intelligence Type: Security intelligence update
 	Persistence Path: C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\data\e9e47802f2e1577683c4b30c21040ab46bac8666
 	Cloud protection intelligence Version: 0.0.0.0
 	Cloud protection intelligence Compilation Timestamp: 10/29/2025 10:57:06 PM
 	Persistence Limit Type: Duration
 	Persistence Limit: 3000000


_raw:
10/29/2025 06:57:05.165 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=197
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
10/29/2025 06:57:05.165 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=196
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\Program Files\Windows Defender\
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=195
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Features\EcsConfigs\ETag\Tag =
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag\Tag = "kvtegMip1fPqVr3s2FyBqJrWphtD5o5jr0NpA7QjGj0="


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=194
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFc_Kernel_UseLowPriAsyncScansDevDrvOnly = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=193
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Kernel_PPLReduxMitigationFlags = 0x3


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=192
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_AdvertiseM365PackMinor = 0x2328


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=191
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpDisablePropBagNotification = 0x0


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=190
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_M365ToastCurrentVerRollout = 0x64


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=189
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFc_Kernel_UseLowPrioThreadsForAsyncScans = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=188
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableTPExclusionsSCCMNonMDEAttach = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=187
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\NIS_DisableTransportCallouts = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=186
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpForceDllHostScanExeOnOpen = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=185
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_M365StablePackVer = 0x96B4268


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=184
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFc_Kernel_L2StateCache_SupportGenericFileState = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=183
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_AdvertiseM365PackMajor = 0x67


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=182
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_AdvertiseM365PackBuild = 0x0


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=181
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpEnablePurgeHipsCache = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=180
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Kernel_SystemIoRequestWorkOnBehalfOf = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=179
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_DC_AllowLockedSessionsAsLastLogon = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=178
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_M365SsoFeature = 0x3


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=177
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_M365CurrentPackVer = 0x96B4650


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=176
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Kernel_ReduceOfficeInjectRuleFP = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=175
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Kernel_HardenUxProcesses = 0x0


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=174
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Kernel_EnableFolderGuardOnPostCreate = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=173
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_AdvertiseM365Feature = 0x0


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=172
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpDlpClipboardSettings = 0x18F


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=171
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\EnableThreatIdKeyForSigExpiry_MpRamp = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=170
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Throttle_ScanThreads_Equally = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=169
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFc_Kernel_DisableOfficeInjectUevSuppression = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=168
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_DisableTransportCallouts = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=167
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_DC_EnableAadSidCache = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=166
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpDisableResourceMonitoring = 0x0


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=165
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpCopyAcceleratorCancellableCopyState = 0x2


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=164
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\EnableBmProcessInfoMetastoreMaintenance_MpRamp = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=163
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableMdeDiag = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=162
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpDisableCmdLineNormalizationKC = 0x0


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=161
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\NIS_EnableUsoSupport = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=160
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpDisableBmHealthOneDsEvent = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=159
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_M365ToastFeature = 0xF


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=158
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFc_Kernel_L2StateCache_DefaultStreamsOnly = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=157
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableOnDemandScan1DSMetrics = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=156
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_EnableImpersonationOnNetworkResourceScan = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=155
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_QuarantineItemAgeInSeconds = 0x3


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=154
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_Dlp_EventThrotteIntervalInSec = 0xF


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=153
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_AllowTrustAnchorsForTLS = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=152
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\EnableCIWorkaroundOnCFAEnabled_MpRamp = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=151
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\EnableAdsSymlinkMitigation_MpRamp = 0x1


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=150
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFC_M365SsoCurrentVerRollout = 0x64


_raw:
10/29/2025 06:57:02.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-socal-t8-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=149
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\MpFc_Kernel_MaxAsyncWorkQueue = 0x400