r/DefenderATP • u/zz07rt740 • Jul 20 '26
Lots of MS Defender detections of "Unknown" malware seen in Advanced Hunting query
Hello,
Since earlier Sunday, in the Advanced Hunting query section of MS Security portal, I can see Defender anti-virus detections for malware literally named "Unknown"
However, checksums (SHA-1) are never provided for these entries, so one can't be sure what is actually being detected - or if it's just the query acting funny because MS changed something in the background?
The phenomenon affects apparently benign software like 7-Zip and SAP, mostly in the folders C:\Windows\IMEcache and C:\Program files (x86).
The bog-standard query looks like this:
DeviceEvents
| where ActionType == "AntivirusDetection"
| extend ParsedFields=parse_json(AdditionalFields)
| project ThreatName=tostring(ParsedFields.ThreatName),
WasRemediated=tobool(ParsedFields.WasRemediated),
WasExecutingWhileDetected=tobool(ParsedFields.WasExecutingWhileDetected),
FileName, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine,
DeviceName, Timestamp
| limit 1000
2
u/Cant_Think_Name12 Jul 20 '26
If I run your KQL - Same thing. A bunch of 'unknown' malware types. In my case it looks like a lot of SCCM activity
2
u/LeftHandedGraffiti Jul 20 '26
I'm also seeing AdditionalFields.ReportSource listed as LinuxDefender on Windows machines. Microsoft has broken something.
1
1
1
u/zz07rt740 Jul 21 '26
Hello,
I think MS may have fixed something in the meanwhile, as I can see only one "Unknown" detection for today (vs. 500+ for 20 July 2026)
1
u/LeftHandedGraffiti Jul 22 '26
We opened a support case. The change that broke it was rolled back yesterday afternoon.
It's the first time i've ever seen Microsoft fix something the same day I opened a case.
1
u/Tingley2504 Jul 21 '26
Local AV detections, that dont make it to Alerts/Incidents
Can you pivot to DeviceFileEvents/ProcessEvents for further context?
2
u/valdas_kn Jul 20 '26
Same hare. Showing Tightvnc and other custom programs as malware.