# Real-time, behavioral, and heuristic protection are enabled on Microsoft Defender Antivirus
Microsoft Defender Antivirus uses cloud protection, always-on scanning with file and process behavior monitoring and heuristics, and protection updates to…
Source: https://maester.dev/docs/tests/ZTA.41055
## Overview
Microsoft Defender Antivirus uses cloud protection, always-on scanning with file and process behavior monitoring and heuristics, and protection updates to detect and block threats. Microsoft defines always-on protection as real-time protection, behavior monitoring, and heuristics that identify malware from known suspicious and malicious activities, such as unusual process changes to files, autostart registry keys, startup locations, and other file-system or file-structure changes. Real-time protection scans files when users open, download, or use them, so disabling these controls reduces endpoint protection before suspicious or malicious activity can be identified locally. Tamper protection helps keep always-on protection and other security settings from being changed, but this check does not evaluate tamper protection. Microsoft Secure Score measures organizational security posture and includes recommendations for Microsoft Defender for Endpoint; this check reads Secure Score control profiles and the latest Secure Score snapshot for the spec-pinned MDATP IDs `scid_2012`, `scid_91`, `scid_92`, `scid_89`, `scid_90`, `scid_5093`, and `scid_6093`.
## Remediation
- [Configure behavioral, heuristic, and real-time protection](https://learn.microsoft.com/en-us/defender-endpoint/configure-protection-features-microsoft-defender-antivirus)
- [Enable and configure always-on protection](https://learn.microsoft.com/en-us/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus)
- [Use Microsoft Intune to manage Defender Antivirus settings](https://learn.microsoft.com/en-us/mem/intune/protect/antivirus-microsoft-defender-settings-windows)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Endpoint threat protection |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Endpoint antivirus |
| Area | Devices and endpoints |
| ATT&CK | [T1204.002](/docs/tests?mitre=T1204.002) Malicious File, [T1059](/docs/tests?mitre=T1059) Command and Scripting Interpreter |
| Licence | WINDEFATP, MDE_LITE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.