Protection
في هذه الصفحة
Protection answers: what protects the host from malware, and does it work - what it detected, what became of each detection, and who turned it off.
At a glance
Question | What protects the host from malware, and does it work? |
Reads | Windows Security Center's products, Microsoft Defender's status, exclusions, log and detection history, and Windows' own protections. |
Rule prefix |
|
What it reads
Source | Evidence |
|---|---|
Windows Security Center (WMI) |
|
Defender's status and preferences (WMI) |
|
Defender's Operational log |
|
Defender's detection history |
|
Code integrity, AppLocker, the firewall's log |
|
Windows' own protections (registry, Device Guard, BitLocker) |
|
Signals it raises
25 rules: 13 high, 11 medium, 1 low. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| high | Defender is active but its AMSI provider is not registered | run facts |
|
| high | An AMSI provider that is not an antivirus's is registered |
|
|
| high | A threat was detected and not remediated |
| - |
| high | Every Windows Firewall rule was deleted |
|
|
| high | No antivirus is active on the host | run facts |
|
| high | Antivirus protection was turned off |
|
|
| high | The antivirus failed to remediate a threat |
| - |
| high | A quarantined item was restored |
|
|
| high | Tamper Protection blocked a change to the antivirus |
|
|
| high | Tamper Protection was turned off |
|
|
| high | A detected threat was allowed |
|
|
| high | User Account Control is off |
|
|
| high | Windows keeps clear-text passwords in memory (WDigest) |
|
|
| medium | A script was stopped as it ran (AMSI) |
|
|
| medium | Cloud-delivered protection was turned off |
|
|
| medium | Windows blocked a driver or program its policy does not allow |
|
|
| medium | A remediated threat came back |
|
|
| medium | An antivirus exclusion was added |
|
|
| medium | Exploit protection blocked a program's operation |
| - |
| medium | A Windows Firewall profile is off on the host itself |
|
|
| medium | A protection of the active antivirus is off now |
|
|
| medium | A real-time protection feature failed |
|
|
| medium | Local administrators get full rights from the network |
|
|
| medium | A risky antivirus exclusion is configured |
|
|
| low | A threat was detected and remediated |
| - |
How to read it
Telemetry lists each protection's state (Real-time protection, Tamper Protection, Credential Guard...). While a protection is off it detects and records nothing - so its silence means nothing.
A detection's outcome matters most:
remediated,remediation failed,allowed,no action. A threat detected again after remediation is flagged separately.Exclusions are listed exactly as configured. An empty list means none; an absent list means they could not be read.
What it can't see
Next
Network: what the host listens on and talks to.