defender.quarantine#
$ target-query <path/to/target> -f defender.quarantine
Module |
|
Output |
|
Module documentation
Plugin that parses artifacts created by Microsoft Defender.
This includes the EVTX logs, as well as recovery of artefacts from the quarantine folder.
Function documentation
Parse the quarantine folder of Microsoft Defender for quarantine entry resources.
Quarantine entry resources contain metadata about detected threats that Microsoft Defender has placed in quarantine.