Microsoft Defender Antivirus detections on this PC

#Requires -RunAsAdministrator
#Requires -Modules Defender
# Microsoft Defender Antivirus detections on this device, newest first. Read-only.

$threatNames = @{}
Get-MpThreat | ForEach-Object { $threatNames[$_.ThreatID] = $_.ThreatName }

$statuses = @{
    0 = 'Unknown'; 1 = 'Detected'; 2 = 'Cleaned'; 3 = 'Quarantined'; 4 = 'Removed'; 5 = 'Allowed'; 6 = 'Blocked'
    102 = 'QuarantineFailed'; 103 = 'RemoveFailed'; 104 = 'AllowFailed'
}

$detections = @(Get-MpThreatDetection)
if ($detections.Count -eq 0) {
    Write-Output 'No Microsoft Defender Antivirus detections are recorded on this device.'
}

$detections |
    Sort-Object InitialDetectionTime -Descending |
    ForEach-Object {
        $statusId = [int]$_.ThreatStatusID
        [pscustomobject]@{
            Detected      = $_.InitialDetectionTime
            Threat        = $threatNames[$_.ThreatID]
            Status        = if ($statuses.ContainsKey($statusId)) { $statuses[$statusId] } else { $statusId }
            ActionSuccess = $_.ActionSuccess
            User          = $_.DomainUser
            Process       = $_.ProcessName
            Resources     = $_.Resources -join '; '
            Remediated    = $_.RemediationTime
        }
    }

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

The Windows device you want to check, in an elevated Windows PowerShell 5.1 session.

Reading the output

• Each row is one detection from Get-MpThreatDetection; the threat name comes from Get-MpThreat. Property meanings are from Microsoft's MSFT_MpThreatDetection and MSFT_MpThreat class references.
• Status is the ThreatStatusID translated with the values in that reference (Detected, Cleaned, Quarantined, Removed, Allowed, Blocked and the failed variants). Anything else is shown as the number.
• ActionSuccess False, or a status ending in Failed, means the clean-up didn't complete and the device needs attention.
• Prints a line saying so when there are no detections.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.