_raw:
11/05/2025 09:30:45.406 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:30:31.895 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
11/05/2025 09:30:26.632 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:30:17.062 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:30:17.062 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:30:13.973 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:30:10.332 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:30:09.754 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:30:09.659 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
11/05/2025 09:30:03.093 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:30:03.093 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:29:58.247 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:29:58.247 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=Deckhand-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:29:14.904 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:28:58.469 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:28:46.113 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:28:46.113 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:28:27.862 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:28:27.862 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-southeast-t2-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:28:26.611 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:28:25.923 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
11/05/2025 09:28:17.534 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:28:09.846 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:27:58.553 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:27:54.084 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:27:44.769 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:27:39.768 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:27:29.543 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:27:28.855 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
11/05/2025 09:27:16.735 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=46
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport

 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport
ENTRAHB:https://wdcp.microsoft.com/wdcp.svc/entraReport
ENTRAHB:https://wdcpalt.microsoft.com/wdcp.svc/entraReport


_raw:
11/05/2025 09:27:16.734 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=45
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
11/05/2025 09:27:16.734 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=44
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
11/05/2025 09:27:16.734 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=43
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\9 = 0x1


_raw:
11/05/2025 09:27:16.734 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=42
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/05/2025 09:27:16.315 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=41
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.716.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.17300.4


_raw:
11/05/2025 09:27:16.315 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=40
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.716.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.17300.4


_raw:
11/05/2025 09:27:16.315 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2002
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=39
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus engine version has been updated.
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.17300.4
 	User: NT AUTHORITY\SYSTEM


_raw:
11/05/2025 09:27:02.387 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:27:01.699 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
11/05/2025 09:26:56.722 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=44
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport

 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReportingLocation =
SOAP:https://wdcp.microsoft.com/WdCpSrvc.asmx
SOAP:https://wdcpalt.microsoft.com/WdCpSrvc.asmx
REST:https://wdcp.microsoft.com/wdcp.svc/submitReport
REST:https://wdcpalt.microsoft.com/wdcp.svc/submitReport
BOND:https://wdcp.microsoft.com/wdcp.svc/bond/submitreport
BOND:https://wdcpalt.microsoft.com/wdcp.svc/bond/submitreport
ENTRAHB:https://wdcp.microsoft.com/wdcp.svc/entraReport
ENTRAHB:https://wdcpalt.microsoft.com/wdcp.svc/entraReport


_raw:
11/05/2025 09:26:56.721 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=43
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\BddUpdateFailure = 0x0


_raw:
11/05/2025 09:26:56.721 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=42
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Miscellaneous Configuration\DeltaUpdateFailure = 0x0


_raw:
11/05/2025 09:26:56.721 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=41
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\9 = 0x1


_raw:
11/05/2025 09:26:56.721 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=40
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\7 = 0x1


_raw:
11/05/2025 09:26:56.277 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=39
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.716.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.17300.4


_raw:
11/05/2025 09:26:56.277 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=38
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.439.716.0
 	Previous security intelligence Version: 1.321.69.0
 	Security intelligence Type: AntiVirus
 	Update Type: Full
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.17300.4


_raw:
11/05/2025 09:26:56.277 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2002
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=37
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus engine version has been updated.
 	Current Engine Version: 1.1.25090.3001
 	Previous Engine Version: 1.1.17300.4
 	User: NT AUTHORITY\SYSTEM


_raw:
11/05/2025 09:26:45.426 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:26:37.940 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:26:25.677 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:26:25.005 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
11/05/2025 09:26:21.318 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:26:11.600 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:26:06.249 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:26:06.249 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:25:50.934 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:25:50.261 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
11/05/2025 09:25:30.727 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:25:30.039 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
11/05/2025 09:24:40.309 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=38
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:24:39.606 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=37
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
11/05/2025 09:24:28.384 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=36
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:24:27.727 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=35
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup = 0x0


_raw:
11/05/2025 09:22:16.066 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:22:16.066 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:20:23.356 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:20:23.356 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:20:08.304 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:19:24.905 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:19:24.905 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:19:08.113 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:19:08.113 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:18:32.285 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:18:32.285 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:17:56.108 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:17:56.108 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:17:37.142 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:17:37.142 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:17:04.067 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:16:36.128 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=36
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:16:36.128 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=35
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:16:34.062 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:16:34.062 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:16:24.382 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=34
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:16:24.382 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:16:09.063 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:14:11.564 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:14:04.138 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:13:59.412 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:13:28.368 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:13:01.522 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:12:44.537 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:12:34.055 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:12:14.633 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:12:14.633 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:11:55.443 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:11:35.026 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:11:06.637 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:10:37.549 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:10:37.549 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:10:18.649 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=34
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:10:13.339 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=28
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:10:07.248 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5001
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.


_raw:
11/05/2025 09:09:56.974 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:09:55.536 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:09:47.552 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:09:44.484 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=27
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:09:44.484 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:09:29.352 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:09:26.677 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:09:26.677 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:08:59.673 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:08:59.673 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:08:29.910 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=26
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:08:21.184 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:08:06.788 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:08:00.748 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:08:00.747 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:07:59.590 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:07:51.875 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:07:51.875 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:07:22.286 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=25
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:07:17.507 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:07:12.717 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=24
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:07:08.351 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:07:04.827 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=33
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:07:02.871 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:06:46.752 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:06:37.723 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:06:34.651 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=32
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:06:34.650 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=31
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:06:33.779 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=30
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 09:06:33.779 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=APT-DC-01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=29
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:05:40.098 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:05:36.962 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 09:05:31.603 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 09:05:31.462 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 08:28:31.035 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-M9DT2MGAGO5
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 08:28:31.035 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-M9DT2MGAGO5
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 08:28:04.573 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-P4B4CJ857FH
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 08:28:04.573 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-P4B4CJ857FH
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 08:27:59.345 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-P4B4CJ857FH
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 08:27:59.344 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-P4B4CJ857FH
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 08:27:46.432 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-VTCQVCK9DIU
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 08:27:46.432 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-VTCQVCK9DIU
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 08:27:41.480 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-VTCQVCK9DIU
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 08:27:41.480 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-VTCQVCK9DIU
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 08:27:37.124 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-TN98D64F3JD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 08:27:37.124 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-TN98D64F3JD
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 08:25:27.838 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-M9JFOVPRN8U
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 08:25:27.838 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-M9JFOVPRN8U
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 08:25:06.381 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-H5E4IF08TCR
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 08:25:06.381 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-H5E4IF08TCR
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 08:25:01.537 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-H5E4IF08TCR
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 08:25:01.537 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-H5E4IF08TCR
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 08:23:35.898 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q4DCOR23M61
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=23
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/05/2025 08:22:41.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q4DCOR23M61
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=22
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x3


_raw:
11/05/2025 08:22:41.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q4DCOR23M61
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampGradualRelease = 0x1


_raw:
11/05/2025 08:22:41.087 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q4DCOR23M61
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x3


_raw:
11/05/2025 08:22:35.649 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q4DCOR23M61
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 08:22:35.649 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q4DCOR23M61
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 08:21:59.629 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q99PFSR4TKL
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2


_raw:
11/05/2025 08:21:59.629 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q99PFSR4TKL
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=20
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing = 0x2


_raw:
11/05/2025 08:21:50.259 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q99PFSR4TKL
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=19
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/05/2025 08:21:50.259 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-Q99PFSR4TKL
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=18
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/05/2025 08:21:04.920 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=WIN-DL127D7GG33
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=21
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing = 0x2