PowerShell: Check Windows Defender Threat Detection History
Need to check the history of malware detections on a machine - for security auditing or confirming past threats were handled? This one-liner pulls it straight from the system.
Prerequisites:
- Privileges: None
- Module: Built-in, no import needed
Quick Command:
Get-MpThreatDetectionExample Output:
(no output)An empty result here simply means no threats have ever been detected on this machine - it's not an indication the command failed.
📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- Get-MpThreatDetection returns the history of all threat detections Windows Defender has logged on the machine, including ones that were already resolved or removed - unlike Get-MpThreat, which only shows currently active/recent threats.
- Each entry (when present) would include details like the threat name, detection time, and the action taken (quarantined, removed, allowed).
- A clean, empty result is actually the ideal outcome here - it means no malware has ever been flagged on this system.