Windows Defender Antivirus

Why can malware still install onto a PC even with UAC and execution control?

effective social engineering, exploiting a vulnerability to execute without explicit consent, or not needing to install itself to achieve threat-actor objectives

What can social engineering persuade a user to do?

bypass the normal checks

How might malware execute without explicit consent?

by exploiting a vulnerability

What are examples of threat-actor objectives malware might achieve without installing itself?

exfiltrating data, weakening the system configuration, or snooping around the network

What can antivirus (AV) software do?

detect malware and prevent it from executing

What is the primary means of antivirus detection?

a database of known virus patterns called definitions, signatures, or patterns

What is heuristic identification?

using knowledge of the sort of things that viruses do to try to spot and block virus-like behavior

Why is most antivirus software better described as anti-malware?

it can detect software threats that are not technically virus-like

What non-virus-like threats can anti-malware detect?

spyware, Trojans, rootkits, ransomware, and cryptominers

Why is an anti-malware software solution a critical component of workstation security?

the broad range of threats posed by different types of malware and vulnerability exploits

What is a core component of all Windows editions?

Windows Defender Antivirus

Through what is Windows Defender Antivirus managed?

the Windows Security Center

Why is it particularly important that antivirus software be updated regularly?

antivirus is only as good as the latest signatures

What two types of antivirus updates are generally necessary?

definitions and scan engine/component updates

What are definitions?

information about new viruses or malware

How often may definition updates be made available?

daily or even hourly

What do scan engine/component updates do?

fix problems or make improvements to the scan software itself

For Windows Defender Antivirus, how are definitions and patches delivered?

via Windows Update

How might third-party antivirus software handle updates?

integrate its updates with Windows Update or use its own updater

What are definitions also called in antivirus detection?

signatures or patterns

Why should there be no simple means of deactivating an antivirus product?

malware could easily circumvent it

How can Defender Antivirus be disabled temporarily?

by toggling the Real-time protection button

What happens after Defender Antivirus is disabled temporarily?

it will re-activate itself after a short period

What happens if a third-party antivirus product is installed?

it will replace Windows Defender Antivirus

How can Windows Defender Antivirus also be permanently disabled?

via group policy

Why might it be necessary to exclude folders from scanning?

scanning the disk images of virtual machines can cause performance problems, and some legitimate software or development code can trigger false-positive alerts

What type of folders can be excluded from scanning?

folders containing disk images of virtual machines or legitimate software or development code that can trigger false-positive alerts

What is important to check regularly about the antivirus product?

that it is activated and up to date

What Defender Antivirus setting can be enabled or disabled for temporary troubleshooting?

Real-time protection

Where in the Windows Security app is Real-time protection managed?

Virus & threat protection settings > Manage settings > Real-time protection