Microsoft Defender AV: Update Signatures from PowerShell

 

Here's how to update your Microsoft Defender Antivirus signatures using PowerShell:

• Open a PowerShell (or Terminal) as Administrator
• Run the following command: Update-MpSignature -UpdateSource MicrosoftUpdateServer
  
  

Now just wait for the process to finish and you're done! :)

Microsoft Defender AV: Update Signatures from Command-Line

 

If you need to update your Microsoft Windows Defender Antivirus signatures, here's how:

• Open a CMD as Administrator
• Run the following command: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate
  
  

Now just wait the process to finish and you're done!

Microsoft Defender AV: Client Logs

 

For everyone implementing Microsoft Windows Defender Antivirus, here's a quick note where to find the client logs and how to use them:

• C:\ProgramData\Microsoft\Windows Defender\Support
• MPLog-######-#####.log
• MPDetection-######-#####.log
• MPCacheStats.log (Defender Only)
  
  

You should use the MPLog to:

• Search Threat Name to locate a record of malware detection.
• Search Scan Source to locate a record of a scheduled scan running or record a running scan that is on demand.
• Search Expensive file to locate an instance of an expensive file detection during a scan.
• Seach on update process

Microsoft 365 – Windows Defender Advanced Threat Protection (WDATP) – Implementation Docs

With more and more enterprises embracing digitalization and also the Microsoft Cloud solutions, there’s a nice add-on to Microsoft 365 subscriptions (or if you’re using E5 tier) called Windows Defender Advanced Threat Protection or WDATP.

WDATP is a unified, cloud based platform for, preventative protection, post breach detection, automated investigation and response.

You can read a little bit more about it here:
Microsoft 365 - Windows Defender Advanced Threat Protection – Overview

But this post is about what you need to do to implement it in your organization.

Below are direct links to Microsoft documentation that helps to easily implement and troubleshoot WDATP:

WDATP - Onboard Windows 10 machine

WDATP - Run a detection test on a newly onboarded Windows Defender ATP machine

WDATP - Configure machine proxy and Internet connectivity settings

WDATP - Enable access to Windows Defender ATP service URLs in the proxy server

WDATP - Troubleshoot Windows Defender Advanced Threat Protection onboarding issues

Tips&Tricks – Attention When Changing Windows Defender Firewall Default Log Path

Although nowadays you could (err…should) configure event viewer (or centralized logging) for your Windows Defender Firewall, here’s a tip for something I’ve noticed when changed the default Windows Defender Firewall location.

When applying a GPO to do this, you must keep in mind that MpsSvc service account is responsible to write down the Windows Firewall log, so, if you change the default location (%windir%\System32\LogFiles\Firewall) you need to give it the right NTFS permissions.

So basically what you need to do:

1. Change the default location for the Windows Firewall log
2. Go to the new location
3. Right-click the folder and then Properties
4. Click the Security tab and Edit
5. Now, click Add
6. Make sure that you’ve select the local computer and not the domain (in “Locations…”)
7. Now type NT Service\MpsSvc and click OK
8. Make sure MpsSvc has Write Access and click OK again

And…you’re done!

Tips & Tricks – Import/Export Windows Firewall Settings Command-Line

Here’s a nice tip for those that for some reason need to configure Windows Firewall (or Windows Defender Firewall on Windows 10).

The recommended way to do this should be using a group policy but because you may have a non-domain joined machine on your network, here’s how to do it.

1. First of all, configure everything you need in Windows Firewall on a reference machine
2. Then, open an elevated command-prompt and type the following command:
   netsh advfirewall export “C:\Temp\WindowsFirewallRules.wfw”
   
   
3. Now that you have the file, you can import it to any machine using the following command:
   netsh advfirewall import “C:\Temp\WindowsFirewallRules.wfw”
   
   

If for any reason you need to reset firewall rules to default values just type:
netsh advfirewall reset