Defender blocked a threat (elevated risk) - How do I find out which program?

rogerrabbit · 2026-07-02T03:11:34-0400

Hi,

I received a notification this morning that Windows Defender blocked a threat (elevated risk) and quarantined it.

After following the link in the notification, the message shown in the attached screenshot was displayed.

How can I find out which program contained (or contains) the hack tool?

Task Manager is of no help because the indicated PID (2844) is no longer running.

Thanks in advance!

FreeBooter · 2026-07-02T03:16:40-0400

Searching for thread name will help also see if Defender took action on thread like removed it.

FreeBooter · 2026-07-02T03:17:48-0400

HackTool:Win64/Mimikatz threat description - Microsoft Security Intelligence

kelper · 2026-07-02T03:19:25-0400

Look at your browser history for that date and time.

echo2446 · 2026-07-02T03:39:02-0400

rogerrabbit said:
How can I find out which program contained (or contains) the hack tool?

Try Event Viewer, filtered on "Event sources: Windows Defender", and check the logs around that time to see if it has more details.

rogerrabbit · 2026-07-02T04:10:50-0400

echo2446 said:
Try Event Viewer, filtered on "Event sources: Windows Defender", and check the logs around that time to see if it has more details.

Thanks (to all of you) !
I suppose it came from the internet and not from a program installed.
I tried your idea @echo2446, but it says "log clear" just for the time of the event (08:31).

Never mind, I think the thread is deleted and I will see in the future whether some programm is not working (correctly) anymore !

kelper · 2026-07-02T04:16:16-0400

Download Malware bytes free and do a full scan, just to be sure.

antspants · 2026-07-02T04:48:11-0400

Mimikatz is an open-source credential extraction tool, probably one of the strongest. Generally comes packaged in executable's that are created for the purpose of bypassing software license requirements. Funny, it gives people something and takes way more lol
However not the only way to cop a sniff of it, I suppose.

antspants · 2026-07-02T04:51:01-0400

Let us know if you find where it came from. There are of course (apparently) legitimate uses for it, so maybe in context of where it came from, it could be a false positive of sorts.

rogerrabbit · 2026-07-02T06:08:50-0400

kelper said:
Download Malware bytes free and do a full scan, just to be sure.

Ok, I did it ! It didn't find anything.

@antspants
The only programs I downloaded yesterday were updates for Tutamail and Thunderbird. So I don't think that this was at the origin. Ok, I will report back if I find out something.

Thanks

Try3 · 2026-07-02T06:17:03-0400

rogerrabbit said:
How can I find out which program contained (or contains) the hack tool?

This batch script will list the original location & filename of all quarantined items.
It must be run as Admin.

:: Simplify the command line prompt for ease of comprehension during testing
prompt $g

Title List current quarantined items

:: search for the latest subfolder in %ProgramData%\Microsoft\Windows Defender\Platform
:: It processes all subfolders in sequence so that last one to be set is the latest one
set GetLatestVersionPath="dir "C:\ProgramData\Microsoft\Windows Defender\Platform" /ad /od /b"
FOR /F "tokens=*" %%i IN (' %GetLatestVersionPath% ') Do Set LatestVersionPath=%%i

"C:\ProgramData\Microsoft\Windows Defender\Platform\%LatestVersionPath%\MpCmdRun.exe" -restore -listall

Pause to review results

Note that, despite the inclusion of the word restore, this just lists items, it does not take any action.

Sample output:-
Read from the line The following items are quarantined
[I always display all the output to help me with any debugging that proves necessary.]

Denis

Try3 · 2026-07-02T06:20:14-0400

rogerrabbit said:
It didn't find anything.

It wouldn't. The potentially-offending file has been put in quarantine by WD so, as far as MWB or any other programme is concerned, it does not exist.

Denis

rogerrabbit · 2026-07-02T06:36:52-0400

Try3 said:
This batch script will list the original location & filename of all quarantined items.
It must be run as Admin.

Denis

Thank you very much !

Unfortunately the output only shows two threats from 03/05/2026 at not the one of this morning 02/07/2026 at 08:31 (see attached).

Strange ! Why does Defender hide this information ?
Why does the event wiever see an event, but says: "log clear" at 08:31 (the time of the threat) ?

antspants · 2026-07-02T06:52:12-0400

ThreatName = Trojan:Win32/Cerdigent.A!dha
A malicious trojan, probably worse than Mimikatz.

Root certificates are extremely sensitive. If a trojan installs its own root certificate, it can make malicious HTTPS traffic appear “trusted” intercept encrypted communications, impersonate legitimate websites, bypass browser warnings, sign malicious files so they appear safe.
Defender quarantined 2 root certs.
I'll be honest, if it were my PC I'd be reinstalling. But then again, I'm paranoid.

antspants · 2026-07-02T06:54:25-0400

If defender grabbed them then you could be fine. But where did it all come from?
Apologies but I have to ask, have you run any cracks to use software for free?

echo2446 · 2026-07-02T06:59:45-0400

rogerrabbit said:
but it says "log clear"

rogerrabbit said:
"log clear" at 08:31 (the time of the threat) ?

This definitely isn’t normal and could be bad, since Windows itself doesn’t do this for recent events (your previous events haven’t been cleared). The clearing may be work of malware.

You might want to post the details from that "clear-log" entry: double-click the entry, click the Details tab, then click Friendly View. Copy the info using the Copy button at the bottom, and paste it here (redact anything sensitive).

@rogerrabbit : At this point, I’d probably try another scanner. Maybe the ESET Online Scanner, or the Kaspersky Virus Removal Tool (if you’re not restricted).

antspants said:
A malicious trojan, probably worse than Mimikatz.

There was a bad Windows Defender update that briefly flagged legitimate root certificates at the end of April. Do you think the OP might have had that update?

antspants · 2026-07-02T07:04:27-0400

echo2446 said:
There was a bad Windows Defender update that briefly flagged legitimate root certificates at the end of April. Do you think the OP might have had that update?

Could be, Echo. I was oblivious to it? But yeah maybe. At the least, scan it with everything known to man. Or a system image? We love and encourage those here, rogerrabbit

rogerrabbit · 2026-07-02T08:46:31-0400

antspants said:
Apologies but I have to ask, have you run any cracks to use software for free?

Thanks, I appreciate your directness. But the only program I have on my PC, which is neither paid, nor completely free, is an old giveaway version of VCF editor, directly downloaded from Vovsoft, which I haven't used since months however.

I don't really understand your last sentence and why you put a link to my profile.

---

@echo2446

The detail of the event log is not very informative and gives a SID which is mine and a not very helpfull link to: http://manifests.microsoft.com/win/2004/08/windows/eventlog, see below (hope I have redacted everything sensible)

"Nom du journal :Security

Source : Microsoft-Windows-Eventlog

Date : 02/07/2026 08:31:24

ID de l’événement :1102

Catégorie de la tâche :Log clear

Niveau : Information

Mots clés : Succès de l’audit

Utilisateur : N/A

Ordinateur : DELETED

Description :

Le journal d’audit a été effacé.

Objet :

ID de sécurité : DELETED/DELETED

Nom de compte : DELETED

Nom de domaine : DELETED

ID de connexion : 0x52E4A

XML de l’événement :

<Channel>Security</Channel>

<Computer>DELETED</Computer>

</System>

<SubjectUserName>DELETED</SubjectUserName>

<SubjectDomainName>DELETED</SubjectDomainName>

</LogFileCleared>

</UserData>

</Event>

To both (also to @antspants)

Yes, I'll probably do a clean install (I am still hesitating a bit). I have a Windows image (the old Windows 7 imaging program) from June, 18 which has however been created after the events of May, 03 and a few even more recent Hasleo backups. So if there is really a problem they are not very helpful.

Thanks

Try3 · 2026-07-02T09:42:21-0400

rogerrabbit said:
Why does the event wiever see an event, but says: "log clear" at 08:31 (the time of the threat) ?

Like the others, I find the "log clear" highly suspicious.

Event viewer does record detections & quarantines:-
Log name: Microsoft-Windows-Windows Defender/Operational
Source: Windows Defender
EventID: 1116,1117
e.g.
This is a 1117 record, the quarantine event. You can also see 1116, the detection event, 21 seconds earlier [its details pane does not show any additional info beyond that shown for 1117].

Just as an experiment, I just told WD [Protection history] to remove the 23/4/26 item shown above.
As expected, that item has now disappeared from the output of my quarantine list batch script.
But its Event viewer record remains.
So I conclude that something took the deliberate action of clearing your log and, if it was not you, then it was something else.
I would run a WD offline scan but I would not trust a negative result & wouldn't trust any of my existing disks in that case either.

Denis

echo2446 · 2026-07-02T09:45:22-0400

rogerrabbit said:
ID de l’événement :1102
<SubjectUserSid>S-1-5-21-3795828713-1622907658-1058423388-1000</SubjectUserSid>
<SubjectUserName>DELETED</SubjectUserName>

I think this means it shows YOU as the source for clearing the log entry, which probably implies malware running in your context. Even if Defender managed to quarantine the other binary, maybe something else cleared the entry—something that might not have been mitigated.

Ref: Decoding Windows event logs: A definitive guide for incident responders

As you already know, reinstalling Windows / rolling back the image is probably the best bet. An alternative is heading to those well-known malware removal forums, which seem to clear infections for most people, but not all.

Defender blocked a threat (elevated risk) - How do I find out which program?

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer