Real-time, behavioral, and heuristic protection are enabled on Microsoft Defender Antivirus

Overview

Microsoft Defender Antivirus uses cloud protection, always-on scanning with file and process behavior monitoring and heuristics, and protection updates to detect and block threats. Microsoft defines always-on protection as real-time protection, behavior monitoring, and heuristics that identify malware from known suspicious and malicious activities, such as unusual process changes to files, autostart registry keys, startup locations, and other file-system or file-structure changes. Real-time protection scans files when users open, download, or use them, so disabling these controls reduces endpoint protection before suspicious or malicious activity can be identified locally. Tamper protection helps keep always-on protection and other security settings from being changed, but this check does not evaluate tamper protection. Microsoft Secure Score measures organizational security posture and includes recommendations for Microsoft Defender for Endpoint; this check reads Secure Score control profiles and the latest Secure Score snapshot for the spec-pinned MDATP IDs scid_2012, scid_91, scid_92, scid_89, scid_90, scid_5093, and scid_6093.

Remediation

• Configure behavioral, heuristic, and real-time protection
• Enable and configure always-on protection
• Use Microsoft Intune to manage Defender Antivirus settings

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Endpoint threat protection
Product	Defender
Feature	Endpoint antivirus
Area	Devices and endpoints
ATT&CK	T1204.002 Malicious File, T1059 Command and Scripting Interpreter
Licence	WINDEFATP, MDE_LITE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.