>

List Defender Malware Detections with PowerShell

Get-MpThreatDetection reveals the full detection history the Windows Security app doesn't show.

WindowsdefenderpowershellauditLow risk
Run Get-MpThreatDetection to list every past detection; pair ThreatID with Get-MpThreat for names and severity.

01Command

Command
$ Get-MpThreatDetection | Sort-Object InitialDetectionTime -Descending | Select-Object -First 10 InitialDetectionTime, ProcessName, Resources, ThreatID

02What it does

The Windows Security interface only surfaces recent threats, while Get-MpThreatDetection retains a longer history with the file path, the process that triggered it, and the detection time. Passing the ThreatID to Get-MpThreat resolves it into a human-readable name and severity level. This is the quickest audit trail when you suspect something was quarantined days ago and the UI shows nothing.

03Risk

RiskLow risk

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Get-MpThreatDetection (Defender module)
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents Get-MpThreatDetection returning past malware detections with timestamps, resources and threat IDs.
  • Get-MpThreat (Defender module)
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents Get-MpThreat, which pairs with Get-MpThreatDetection to translate ThreatID values into threat names and severity.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Grep on Windows: Select-String
Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17
Zip Files with Compress-Archive
WindowsZip & Archivesarchivepowershell

Create or update a .zip from any files or folder contents straight from PowerShell.

Low risk ✓ 2026-09-17
Test a TCP port connection on Windows with Test-NetConnection
Windowsnetworktroubleshootingpowershell

A built-in PowerShell one-liner that answers 'is port 5432/3389/443 actually open through this network?' — no telnet client needed.

Low risk ✓ 2026-09-17