What is Microsoft Defender Antivirus (MDAV)?
Microsoft Defender Antivirus (MDAV) is the antivirus component built into Windows. It ships with the operating system, runs without a separate license, and covers the fundamentals a host needs to block and quarantine known threats: signature-based detection, behavioral analysis, and cloud-delivered protection. On most Windows estates it's already there and already running, which makes it the default endpoint reality for a large share of the machines a security team has to defend. For a SOC, the useful question isn't whether MDAV is good. It's capable at what it does. The question is what its telemetry gives you, where its blind spots are, and how to build detection that holds up when an attacker tries to switch it off. That's the angle this page takes, and it's grounded in Sekoia's own detection engineering work around MDAV rather than in a feature tour.
Key takeaways
- MDAV is built into Windows. It's the antivirus you get by default on a standard Windows machine, with no extra license required.
- MDAV is not the same as Microsoft Defender for Endpoint. MDAV is prevention on the host; Defender for Endpoint is the enterprise EDR built on top of it.
- Attackers routinely try to disable or tamper with it. Turning off protection, removing signatures, stopping services, and bypassing AMSI are all common steps in an intrusion.
- Its telemetry is worth collecting. MDAV alerts and event IDs are a genuine addition to a detection environment, not just noise to be filtered out.
- MDAV covers one endpoint, not the estate. A SOC still needs cross-source detection to correlate what a single antivirus agent can't see on its own.
MDAV, Defender for Endpoint, and Microsoft 365 Defender
Microsoft has renamed and reorganized its Defender products several times, which is why the names get confused. Three of them matter for this discussion, and they sit at different scopes.
The distinction that trips people up most is MDAV versus MDE. MDAV is the protection component; MDE is the enterprise platform that consumes and extends it. When someone says "we have Defender," it's worth confirming which one they mean, because the detection and response capability lives in MDE, not in MDAV alone.
How MDAV protects a Windows host
MDAV combines a few detection methods. Signature-based detection matches files and processes against a known-threat database that updates through Windows Update. Behavioral analysis watches how code acts rather than what it matches, which catches threats that don't yet have a signature. Cloud-delivered protection sends suspicious samples to Microsoft's backend for a faster verdict on new and emerging malware.
Beyond straight detection, MDAV can shrink a host's attack surface through Controlled Folder Access and Attack Surface Reduction rules, which constrain the behaviors malware relies on. It also registers as an AMSI provider, the Windows interface that lets security products inspect scripts and other content at runtime. A large share of what MDAV catches comes through AMSI, which is exactly why attackers target it.
Why attackers go after MDAV
Because MDAV is present on almost every Windows host, disabling or evading it is a recurring step in intrusions. Sekoia's TDR team documented the common techniques and, more importantly, how to detect them. The techniques fall into a handful of categories.
- Disabling protection. An attacker with the right privileges can switch off continuous monitoring outright.
- Adding exclusions. Rather than switch MDAV off, an attacker can exclude a directory so their tooling runs unscanned. This is stealthier than a full disable.
- Removing signatures. Wiping the embedded signature base leaves MDAV running but unable to match known threats, which avoids the alerts a full shutdown would raise.
- Stopping services. MDAV depends on a set of Windows services. Stopping them disables protection, though it needs high privilege and tends to trip an alert if done incorrectly.
- Bypassing AMSI. Since much of MDAV's detection flows through AMSI, an attacker can neutralize that interface in memory without touching MDAV's configuration at all.
The practical lesson from TDR's work is that many of these actions look like legitimate administration, so naive detection drowns in false positives. Rules have to be scoped carefully, for instance targeting encoded command variants or specific event IDs, so that the signal is usable in production.
What a SOC should do with MDAV
Two things are worth building. First, detect tampering. Attempts to disable protection, remove signatures, stop Defender services, or bypass AMSI are strong intrusion signals when the detection logic is tuned to keep false positives low. Second, collect MDAV's own alerts. The threats MDAV catches, surfaced through event IDs such as 1116 and 1117, are a real addition to a detection environment even when the same host also feeds an EDR.
This is where the honest framing sits. MDAV is prevention on a single endpoint. It doesn't correlate activity across an estate, and it can't tell you that a login in one place plus a process on another host add up to an intrusion. Sekoia doesn't sell antivirus. Sekoia's SOC platform ingests MDAV telemetry alongside EDR, identity, network, and cloud signals so that a single agent's blind spots are covered by the picture around it. The goal isn't to replace MDAV. It's to build detection that keeps working when MDAV is exactly what the attacker went after first.
Expert insight: Why MDAV telemetry earns its place in the SIEM
Teams sometimes discount MDAV because it's the free, built-in option. That's the wrong instinct. The value to a SOC isn't MDAV's verdicts alone, it's the combination of its threat alerts and the tamper signals that fire when someone tries to blind it. Sekoia's TDR team runs detection rules for MDAV tampering in its own production environment, tuned against real false-positive rates over 30-day windows so the rules stay usable. If you defend Windows, MDAV is already generating signal on nearly every host. Ingesting and correlating it is a low-cost, high-return move.