Windows Defender is enough, if you harden it

Hey, sorry for all the name changes of Microsoft Defender. I work at MSec (Microsoft&#x27;s security org).<p>We ended up absorbing and acquiring a few companies to provide a better offering and a lot of re-branding happened. For example Security Center&#x27;s old portal for active threat protection, automatic remediation, incident investigation etc is all now absorbed into (the better) security.microsoft.com which is (to my understanding, just an engineer) the current and last (for the foreseeable future) rebrand. The team I work at started as one person working on the frontend for MDE (Microsoft Defender for Endpoint) and now has hundreds of people working on the security portal across India, Israel and the US (as well as a few other smaller sites contributing).<p>Also, as an engineer I have to say the offering is good. The anti-virus and the telemetry is worked on by some really smart people. Client information is sacred, logging into production takes multiple audits and PII is scrubbed (heavily) any time logs are needed. We still have a lot of room to improve but I am confident in Microsoft both delivering a good product and acting in good faith (and there is a clear business incentive in the enterprise security space to do so rather than benevolence).

I responded to multiple major compromises during the Hafnium Exchange hacks.<p><a href="https:&#x2F;&#x2F;www.theverge.com&#x2F;2021&#x2F;3&#x2F;8&#x2F;22319934&#x2F;microsoft-hafnium-hack-exchange-server-email-flaw-white-house" rel="nofollow">https:&#x2F;&#x2F;www.theverge.com&#x2F;2021&#x2F;3&#x2F;8&#x2F;22319934&#x2F;microsoft-hafnium...</a><p>In quite a few cases, we identified that ultimately a server has been popped using this unknown zero day, but never before seen webshells and Cobalt strike droppers all ended up dropped on servers and then deleted by Windows Defender. We recommended rebuilds regardless but the product clearly provided more security than people give it credit for.<p>Then we identified a number of places it didn&#x27;t appear to work. Why? The answer was people following &quot;best practices&quot; of adding AV exclusions for the whole web root folder, and for some reason the whole user profile folder.<p>That big Kaseya hack? Every Kaseya user was told by Kaseya to add exclusions for every folder used by the product.<p>One of the understated issues with modern EDR products is people simply following vendor advise and making it useless. I&#x27;ve got a software product that handles payment details that randomly drops EICAR test files in random folders all of the user PC while it&#x27;s running just so it can shut itself down if it detects Defender in use &quot;for support reasons&quot;.<p>All the top EDR products in the world and all the hardening advice you can find can go down the toilet pretty quickly if you let vendors tell you how to run these products - ignoring them is a highly rated hardening tip.

My firm belief is the that hardware vendors do end users a disservice by preloading 3rd party anti-virus software that expires ans requires payment after a period of time for virus signature updates. Typically this 3rd party software disables Defender, so once the pre-installed AV trial runs out, the user is exposed.

My only grief with Windows Defender is its resource use. My Windows 10 computer booted 26 hours ago. Windows Defender is using 2186 MiB of RAM. I don’t think that’s appropriate, even if I have 32 GiB in total.<p>With Office 365 ATP, things get even slower, too, which is not so great on my work device.<p>Detection rate is one thing. Performance is another. Both are important.

The performance and battery life impacts of Windows Defender make it just not worth it for me though. I had a few months where I went back to Linux on my ThinkPad (unfortunately with an nvidia gpu - whose Linux drivers I think caused half my troubles) and it was soo much more performant - but it had enough various annoyances where I just went back to Windows 11 and WSL2.<p>The idea that pushed me over the edge to try it again was that, this time, I&#x27;d try disabling Defender (as I was 1&#x2F;2 convinced the Linux performance boost was not having AV) and keep a fresh&#x2F;clean install strictly limited to Chrome (now that I had gotten used to just using the web versions of everything like Slack, Spotify, etc.), VS Code, WSL2 and that&#x27;s it. Basically what I&#x27;d been doing with Linux. And so far that&#x27;s been great - better performance, runs cooler and quieter, longer battery life etc. than I ever used to have with Windows. It is like a whole new machine.<p>Knowing I don&#x27;t have Defender I am even more careful about what I download (these days almost nothing - especially on the Windows side rather than the WSL2 Ubuntu dev side) and about ensuring everything is patched. But it is such a game-changer I am not going back...

&gt; Sometimes it is easier to break a person than their computer security. Then even the most expensive solution will not help.<p>&gt; Run this bat file!

Defender has been the only worthwhile Windows AV solution for years. All others have been at best, on-par and at worst, net-negative (opening vulnerabilities that would not otherwise exist).

I read it all, and feel dumber than before.<p>Why the convoluted scripts to get admin? Why execing file with &quot;~3&quot; in the name when you can use the proper one? So much needles silly steps, too little actual explaining of anything that would matter.<p>Also, following that will just ensure you can never download curl or nmap lol. ...i guess, maybe i got the whole thing wrong. Who knows. I don&#x27;t.

Windows Defender also features exploit protection: <a href="https:&#x2F;&#x2F;docs.microsoft.com&#x2F;en-us&#x2F;microsoft-365&#x2F;security&#x2F;defender-endpoint&#x2F;customize-exploit-protection?view=o365-worldwide" rel="nofollow">https:&#x2F;&#x2F;docs.microsoft.com&#x2F;en-us&#x2F;microsoft-365&#x2F;security&#x2F;defe...</a><p>And attack surface reduction rules (which you must configure) - which greatly reduces office worker possibility of catching some nasty stuff:<p><pre><code> Block abuse of exploited vulnerable signed drivers Block Adobe Reader from creating child processes Block all Office applications from creating child processes Block credential stealing from the Windows local security authority subsystem (lsass.exe) Block executable content from email client and webmail Block executable files from running unless they meet a prevalence, age, or trusted list criterion Block execution of potentially obfuscated scripts Block JavaScript or VBScript from launching downloaded executable content Block Office applications from creating executable content Block Office applications from injecting code into other processes Block Office communication application from creating child processes Block persistence through WMI event subscription * File and folder exclusions not supported. Block process creations originating from PSExec and WMI commands Block untrusted and unsigned processes that run from USB Block Win32 API calls from Office macros Use advanced protection against ransomware</code></pre>

This is an impossible question because of missing unfilled variables such as threat model, use case and the nature of data protected. I agree with the general sentiment.<p>Let&#x27;s say you&#x27;re a journalist at an important news org. Even for your personal devices, the builtin defender isn&#x27;t enough.<p>There is a fundamental principle for sophisticated actors, that prevention is not enough. Your security software should do monitoring (off device) and do that very well. You are already compromised, you should be looking into the collected data to see where, when and by whom so you can do something about it. Unfortunately in the last fee years the line has been getting very blurry between sophisticated nation state actors and criminals and common criminals trying to score as much loot as possible (mostly due to being forced to use sophisticated tools and techniques because solutions like Defender have gotten very good).<p>You maybe an average joe and still be a target for &quot;sophisticated&quot; actors or you may think you are an &quot;average joe&quot; but your pwnage offers a strategic value to someone resourceful,<p>My advice is to take inventory of the data and resources you have access to and see (with help if needed) what threat model fits your use case. MS does offer a Defender ATP that&#x27;s basically turning on few more switches and sending them a log of everything happening your machine.<p>Back tracking a bit: Defender is really good. Cloud based protection is their secret sauce, turn it on and pretend they are to be trusted with collecting random files from your PC.

Feels like one obvious step would be to make running as a non-admin user easier. Ended up giving up with kids computer given so much required admin password and no way (even through changing program’s options) to actually run a single program with true admin access. Also no way to say, “always allow” some action with some program.

What would be handy in an article like this is an explanation of why the options are turned off by default. Presumably MS didn&#x27;t decide to e.g leave the Ransomware protection turned off out of spite. So presumably there is a compromise between additional protection and ... something?

One problem with Windows Defender I believe is that if you were a malware author the first AV you&#x27;d want to try and bypass is Windows Defender as it&#x27;s the default which is used on most Windows PCs for your &#x27;MVP&#x27;.<p>Bypassing other AVs would really be a &#x27;nice to have&#x27;

I understand that many of you aren&#x27;t in a position to bargain or move the needle here, but <i>no</i> claims of safety made by Microsoft should ever be taken seriously, ever. Not until a serious mea culpa on the <i>extreme</i> harm they&#x27;ve caused in this space.

I have to say I never used an antivirus software before except I guess the built-in one in Windows.<p>I think sandboxes are better for software you don&#x27;t trust. I imagine antivirus heuristics are only useful against a handful of common threats, if at all.

Created a gist as a reference with all of the powershell commands and some additional info from this thread, such as exploit protection. I&#x27;m considering a full script.<p><a href="https:&#x2F;&#x2F;gist.github.com&#x2F;superswan&#x2F;1d6ed59e75273f90a481428964be3ae5" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;superswan&#x2F;1d6ed59e75273f90a481428964...</a>

As a &quot;family SysAdmin&quot; I&#x27;m pretty happy about how good Windows Defender and MRT updates works.<p>Aside from clearly aimed ransomeware, today&#x27;s pretty difficult to have virus problems in Windows. Most of the time I have to repair any Windows machine is due to a driver install problem (specially sound cards) or a system update problem.

I&#x27;ve never used antivirus (other than defender). AFAICT, I wasn&#x27;t ever affected by a virus with one exception, the Blaster (or Sasser) worm. This was before Defender existed.<p>On the other hand, whenever I use a machine with an antivirus, I want to quit my job. Those things are slow. Very slow.<p>My work machine has a multitude of security software that I can&#x27;t disable, heck, I can&#x27;t even touch. Doing a pip install on a common program takes 10, 15 minutes. The same installation on my personal machine takes about one minute. The culprit? The 3 different agents that spins out of control scanning my disk.

I think most antivirus is security theater at this point, unless you&#x27;re using endpoint security like CrowdStrike Falcon, Palo Alto Cortex, Carbon Black, etc. Which, I think only sell to B2B and not consumer.

I haven&#x27;t had a virus problem since the days of Windows 2000.<p>I&#x27;ve had an incredible number of problems caused by antivirus software interfering with legitimate software.

It&#x27;s the first thing I disable in VMs because of what a resource hog it is.

How are people even getting viruses? I&#x27;ve been using Windows to varying degrees since the 1980s, and I&#x27;ve never once in my life gotten a virus. I never used any antivirus software. I let Windows do whatever it does by default, but it never flags anything. Are people picking up viruses from pirated games or something?

Microsoft Defender and microsoft security is a unfunny long lasting joke that even beat UAC stupidity. All they do is invent new protection names and is trying to syphon all possible data from the PC it is supposedly protecting. The copy speed of 7gbs ssd is close to 10 mbs because you getti “protected”. Do you want to get protected even more? Enable cloud protection, enable online account protection, want to submit file to our protected protection to get protected? No, oh, in this way you are not protected anymore! But you know, last 5 days of your computer idling, it was scanned 10 times and nothing found. Thats important to know. Oh wait I found a generic.generic in your old keygen music file on CD, you not protected anymore! But i will try to delete it for ever. So much defending, such protection. WOW!

So the default settings are not secure and I need to go 10 levels deep in gpedit.msc to enable the security features?<p>What?

I use my pc 12+ hours a day, haven&#x27;t installed any 3rd party antivirus software since 2005, and haven&#x27;t encountered a single problem, because I know what I&#x27;m doing. I think all people who read ycombinator should be able to do the same.

How about a simple scheme where software producers can register their .exe with Microsoft and when I download an exe I could verify that the fingerprint of the exe is registered on the Microsoft whitelist? Or is this kind of thing already happening by the Defender?<p>I have never seen a message saying &quot;Defender does not recognize this application, are you sure you want to start it?&quot;<p>Also there&#x27;s a lot of downloadable Open Source software where users are asked to &quot;verify the keys&quot;. Couldn&#x27;t Windows do this kind of thing automatically, or at least make it easy?

Complete useless and waste cpu&#x2F;mem&#x2F;electricity&#x2F;time

I wonder what the performance impact of these changes is. There must be a reason they are disabled by default.

Can anyone point me to the software that this blog uses? Or if the owner is lurking can you tell me what you use for your site?<p>Looks really good, i&#x27;d like to create something similar for my site.

So true. Windows Defender has a ton of neat advanced features and you don’t have to worry about keeping up with some other vendor of security software, either.

Unpopular opinion: Defender can&#x27;t be the best (but yes enough) because it&#x27;s too popular, so every malware creator checks with it.

As a whitehat I can say that the AVs that i found the hardest to bypass was ESET32; Windefender, Kasperky, are just behind.

Cant agree with this, the GPU seems to be a weakness, but in light of nVidia&#x27;s recent hack, I&#x27;d suggest nVidia GPU&#x27;s are the weakness in windows, but I know ATI also have some weaknesses, they are like sim cards working with a mobile phone OS but also independently accessing the mobile phone hardware.

Defender UI is absolutely terrible and keeps deleting things.<p>It is enough for your average user though I&#x27;ll give it that.

Most people don’t even download an antivirus so this is a good walkthrough.

Windows Defender doesn&#x27;t have heuristics&#x2F;behaviour based detection.<p>For example, if you write a simple keylogger using the Windows API in C++&#x2F;Python&#x2F;..., compile it and run it, an antivirus like BitDefender will block it by default. It&#x27;s up to you then to allow it or not.<p>So it can sometimes detect and block unknown malware, a thing that Windows Defender can&#x27;t. So for some people it might make sense to have a more &quot;strict&quot; antivirus.