Getting Started with Microsoft Defender Antivirus for Windows

Onboarding devices into Microsoft Defender for Endpoint (MDE), as you achieved in the last chapter, is only half the battle. Don’t accept the defaults is advice to live by in IT security, so in this and the next three chapters, you will learn how to configure many of MDE’s Windows security capabilities and good practices to follow.

At the heart of MDE’s protective capabilities on Windows 10/11 and Windows Server 2012 R2 or later is Microsoft Defender Antivirus (MDAV). MDAV is available out of the box for Windows 10/11, including for consumers without MDE. However, devices onboarded to MDE and managed in the enterprise context get additional capabilities. On Windows Server, you’ll get its full capabilities by installing the unified agent on Windows Server 2012 R2 and 2016, but you get it by default with Windows Server 2019 and later.

As you may expect, the out-of-the-box configuration is...

Exploring MDAV interfaces

In the next two sub-sections, you will find out about the two primary ways of interfacing with MDAV locally on a device: Windows Security and PowerShell. While not used for at-scale configuration, familiarity with these interfaces is important for troubleshooting, testing, and small-scale deployments. We start with the Windows Security app.

Windows Security

MDAV does not have a dedicated, standalone GUI like many third-party security tools. Instead, it surfaces itself in the Windows Security app, which can also be found in the operating system’s (OS) settings, and leverages the Windows Security Service (SecurityHealthService.exe). The app also includes settings beyond the scope of MDAV. For example, it includes options for Windows Hello authentication. From Windows 10 1709 onwards, it will also show the status of third-party services you may have replaced MDAV with. This is powered by the Windows Security Center Service (WSCSVC), which has APIs...

Exploring MDAV components

In this section, we will examine the fundamental components of MDAV. You’ll learn about the different scan types available and how they remediate threats, exclusion, update management, and use reports or troubleshooting tools to assist your operations.

Scanning

Scanning is fundamental to any antivirus software, and it’s important you understand the different options available. There are three scan types available for Windows clients running MDAV:

• Quick scans: These looks at locations most associated with malware. Examples of this include startup directories and the Windows registry. Quick scans are generally completed in minutes.
• Full scans: These include a quick scan to kick off, then a scan of all files on system-attached disks, including, optionally, removable storage and network storage. Full scans can take hours, depending on the number of files.
• Custom scans: These are scans of locations that are specified by administrators...

Summary

In this chapter, you learned how MDAV sits at the heart of Windows 10’s endpoint protection security capabilities.

We started by exploring the two primary local interfaces to MDAV, Windows Security and PowerShell. We analyzed the basic components of MDAV next, starting with scanning, and you learned the different scan types, when they should be used, and how to do so. This was followed by remediation options such as quarantining threats and also how to make exclusions if you absolutely must. We then finalized our introduction to MDAV by reviewing troubleshooting and report options.

In the chapters that follow, you will learn how MDE’s security capabilities continue in Windows, with advanced MDAV capabilities powered by the cloud, ASR to minimize risk, and other features to protect your environment. The next chapter, Advanced Microsoft Defender Antivirus for Windows, starts that review by teaching you the interesting ways MDAV protects against advanced threats...

Questions

To test your knowledge of the topics covered in this chapter, you can try to answer the following questions. Answers can be found toward the end of the book:

1. Your organization has employees working from home and well-connected, high-bandwidth offices. Staff devices are Windows 10 laptops with no VDI. Which of the following architectural approaches to update management is most appropriate?
   1. Retrieve updates only from Microsoft Update once a day.
   2. Retrieve updates only from file shares every hour.
   3. Retrieve updates from Microsoft Update as first preference, and file shares as second preference, every hour.
   4. Retrieve updates from file shares as the first preference, and Microsoft Update as the second preference, once a day.
2. A colleague has recommended excluding a process with a custom indicator. Which of the following responses is valid? Choose all that apply.
   1. Custom indicators only support full file paths.
   2. A hash of the process file is the only way to exclude that single...

Further reading

For more detail about some topics in this chapter, you can refer to the following material:

• Christopher Brumm has an excellent blog on exception management, including how to monitor for changes to them: medium.com/codex/my-learnings-on-microsoft-defender-for-endpoint-and-exclusions-ddacf2fdd047
• To supplement out-the-box reporting, Fabian Bader has some very useful advanced hunting queries available for monitoring MDAV in his blog: cloudbrothers.info/en/antivirus-scan-complete
• The following blog has guidance on the file share approach to MDAV updates: campbell.scot/microsoft-defender-antivirus-schedule-install-updates-via-network-shares
• Olaf Hartong MVP has a fantastic series of MDE Internals blogs, which include some recommended audit policies that can enhance the level of telemetry ingested by MDE: medium.com/@olafhartong