Microsoft Defender Antivirus

In the Ultra Transcenders books

SC-500SC-200MD-102

Each book explains Microsoft Defender Antivirus in context, with comparison tables and the common traps.

Related terms

• Agentless malware scanning

  Snapshot-based malware check for VM disks that runs Microsoft Defender Antivirus engines with no agent installed. It comes with Defender for Servers Plan 2, not with Defender CSPM by itself.

• Defender Antivirus passive mode

  Mode in which another vendor's antivirus is primary, so Microsoft Defender Antivirus stops remediating while EDR carries on. Windows Server needs ForceDefenderPassiveMode set to enter it.

• Defender for Storage malware scanning

  As blobs are uploaded, Microsoft Defender Antivirus checks them. Charges are per GB, limited each month per account (10,000 GB by default), and results can land in blob index tags, Event Grid, Log Analytics or security alerts.

• DeviceEvents

  Holds a mix of event types from endpoints in advanced hunting, among them alerts from protection features like exploit protection and Microsoft Defender Antivirus.

• MAPS

  Short for Microsoft Active Protection Service. It gives Microsoft Defender Antivirus cloud verdicts on suspect files in seconds, and features like file indicators stop working if it is turned off or blocked.

• Next-generation protection

  The antivirus layer of Microsoft Defender for Endpoint, delivered by Microsoft Defender Antivirus. It blocks malware using real-time scanning, behavioural analysis and cloud-based intelligence.

• PUA

  A potentially unwanted application: software such as bundlers or adware that is not malware but still degrades a device or its use. Microsoft Defender Antivirus can audit or block these through PUA protection.

• Restrict app execution

  Locks a device down so that nothing but Microsoft-signed code can run, by applying a code integrity policy. Microsoft Defender Antivirus must be present; Remove app restrictions lifts it again.