Microsoft Defender's Tamper Protection antivirus feature hits general availability and will be enabled by default for all users in the coming weeks
Tamper Protection prevents malware from disabling Windows Defender features. — Today, Microsoft announced the general availability …
ZDNetCatalin Cimpanu
Context & Ripple Effects
Tamper Protection closes a loophole that had defined Windows malware for years: malicious code disabling the very antivirus meant to stop it. General availability with default-on rollout turns an opt-in setting into baseline behavior for every Windows user.
Malware families whose standard playbook is killing or reconfiguring Windows Defender lose that move against every user who gets the default-on update in the coming weeks.
Microsoft shifts the burden from users knowing to enable protection to attackers needing a new evasion path — no configuration change required on the user side.
Second-order effects
Attack tooling that assumed Defender could be switched off has to pivot toward persistence and memory-based techniques, which is exactly the surface Microsoft's subsequent kernel-hardening and forced blocking of malware-infected SolarWinds Orion installs target.
Third-party antivirus vendors face a higher bar: the free, tamper-resistant baseline shrinks the differentiation available to paid suites on Windows.
Third-order effects
If the pattern holds, Windows security consolidates around default-on, OS-enforced defenses controlled by Microsoft itself — moving the industry's battleground from signature detection to who controls the protected layer.
Default-on platform security also sets expectations regulators and enterprises apply elsewhere: protection that cannot be disabled by users or software becomes the reference model for endpoint policy.
The trend: Endpoint security is shifting from opt-in tools users manage to default-on, OS-enforced protections controlled by the platform vendor.
Tamper protection can be deployed and managed centrally - and securely - through Microsoft Intune, similar to how other endpoint security settings are managed. pic.twitter.com/dk22caBLCB
GootKit was discovered to be adding exclusions to the folder path where the malware was located. Once again, Tamper Protection would prevent this. https://www.bleepingcomputer.com/ ...
It's great to see @microsoft implementing protection for #windowsdefender as I've been seeing some attacks going after Defender and disabling it. Many products offer such features, like @Webroot and @Sophos. https://zd.net/2Me8d2O
But, I am guessing SCCM does something that's above and beyond this, so maybe this doesn't apply. Kind of wish we could get a GPOv2 where this wouldn't apply, too.
Using Windows 10 and not using Tamper Protection? Make sure to enable it and keep it enabled. There is only upside and no downside. Why use it you may ask? Well, it would prevent the following types of attacks. #Windows10 @WindowsATP @msftsecurity
Novter/Nodersok was found to be manually creating various group policies to disable Windows Defender's real-time protection. Tamper Protection would also prevent this. https://www.bleepingcomputer.com/ ...
TrickBot was found to be using the Set-MpPreference PowerShell command to disable various protection settings in Windows Defender. The Windows 10 Tamper Protection feature would prevent this. https://www.bleepingcomputer.com/ ...
Tamper protection now generally available for Microsoft Defender ATP customers. Tamper protection prevents unwanted changes to security settings on devices. With this protection in place, customers can mitigate threats that attempt to disable security protection features. https:/…
Not sure if this applies to SCCM, but it can't work with GPO, at least, because of the way GPOs work. That is, a GPO is doing basically the same thing that a script could do, which means there's no guarantee that protection isn't being disabled by a malicious script.
Microsoft Defender ‘Tamper Protection’ reaches general availability -Now available for home users -Feature to be enabled by default for everyone -You can enable it right now, though, if you don't want to wait https://www.zdnet.com/... https://twitter.com/...