The Microsoft Defender Antivirus user interface is hidden from end users

Overview

The Microsoft Defender Antivirus and Windows Security app exposes user-facing controls that allow a local user to add exclusions, pause real-time protection, ignore detections, dismiss notifications, and modify scan behavior. When the UI is visible to standard end users, an adversary who delivers a payload can use social engineering to instruct the user to add an exclusion path, pause protection, or restore a quarantined file, effectively turning the end user into an unwitting accomplice in weakening the endpoint’s defenses. The risk is amplified in environments where users have been conditioned to follow instructions from what appears to be technical support, because the Windows Security app presents its controls without requiring administrative credentials for several operations. Hiding the app ensures that antivirus configuration is administrator-only and removes the attack path that depends on user interaction with the security UI. Combined with Tamper Protection, this creates a layered defense where neither the user nor a malicious process can weaken endpoint protection without administrative authority managed through Microsoft Intune.

Remediation

• Windows Security experience (Antivirus) policy settings for Intune
• WindowsDefenderSecurityCenter Policy CSP
• Manage endpoint security policies in Intune

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Medium
Pillar	SecOps
Category	Endpoint threat protection
Product	Intune
Feature	Endpoint security
Area	Devices and endpoints
ATT&CK	T1685 Disable or Modify Tools
Licence	INTUNE_A&WINDEFATP
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.