question

Charlene-7522 avatar image
0 Votes"
Charlene-7522 asked Miles-MSFT answered

Windows 10 - When does Windows Defender run when writing files to disk

When writing files to a file system from a database, does real time protection from Windows Defender stop a file from being written to the disk if malware or a virus is detected? Or does it fully write the file to the file system first, scan it, then remove the file if issues are found?

windows-10-security
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

cooldadtx avatar image
0 Votes"
cooldadtx answered

Note: This is my understanding, not an expert answer based upon source code.

File system scanning would occur after the file is written to disk but before it is accessible. Otherwise the file would have to be loaded into memory or partially scanned as it is being written. While I've never looked I suspect the virtual file filter driver used by AV is probably one of the last filters to run so it can catch malware that might have installed themselves in the kernel somehow.

But in addition to file scanning AV tools like defender also have memory components that are running so there is protection for in-memory malware that might never use the file system.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Miles-MSFT avatar image
0 Votes"
Miles-MSFT answered

Hi

The Microsoft Defender Antivirus engine makes note of any file changes (file writes, such as moves, copies, or modifications) and general program activity (programs that are opened or running and that cause other programs to run).

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus?view=o365-worldwide#enable-and-configure-always-on-protection-in-group-policy

Best Regards

--please don't forget to Accept as answer if the reply is helpful--

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.