The Big Picture: The Built-In Security Guard
Walls and locks (Sections 1 to 5) mostly stop things from getting in or from being changed. But sometimes a bad file gets through anyway: a download, an email attachment, a USB stick. You need a guard who inspects what is on the PC and what is running.
That guard is Microsoft Defender Antivirus (commonly still called "Windows Defender"). It is built into Windows 10 and 11, starts automatically, and switches itself to a quieter mode if you install another antivirus.
Names, to avoid confusion:
| Name | What it is |
|---|---|
| Microsoft Defender Antivirus | The antivirus engine that scans and blocks malware |
| Windows Security (app) | The control panel for all the protection features (Defender, firewall, device security...) |
| SmartScreen | A reputation check for downloads and websites |
| Microsoft Defender for Endpoint | A paid business product for companies (not covered here) |
Malware words, explained:
| Word | Plain meaning |
|---|---|
| Malware | Any software made to cause harm |
| Virus / worm | Malware that spreads (a virus attaches to files; a worm spreads over networks) |
| Trojan | Malware pretending to be something useful |
| Ransomware | Malware that encrypts your files and demands payment |
| Spyware | Malware that watches and steals |
6.1 Real-Time Protection
What it is: Real-time protection means Defender checks files at the moment they are used, not only when you press "Scan". When you download a file, open it, copy it, or run it, Defender looks first.
How it sees activity: Defender plugs into Windows with a file-system filter driver (a kernel driver that sits in the path of file operations) and other hooks. When a program touches a file, Defender gets a chance to inspect it and say "allow" or "block".
You double-click setup.exe
│
▼
┌─────────────────────────────┐
│ Windows opens the file... │
└──────────────┬──────────────┘
│ Defender is in the path
┌──────────────▼──────────────┐
│ Real-time scan of the file │
└──────────────┬──────────────┘
clean? │
┌──────────┴──────────┐
▼ ▼
┌────────────┐ ┌─────────────────────┐
│ Runs │ │ Blocked, quarantined│
└────────────┘ └─────────────────────┘
Quarantine. A detected file is not always deleted at once. It is moved to a locked folder (quarantine) where it cannot run. You can restore it from Windows Security → Virus & threat protection → Protection history if it was a false alarm.
Other layers working with real-time protection:
| Feature | What it does |
|---|---|
| Scheduled / quick / full scans | Look through files already on disk. Quick scan checks likely places; full scan reads everything. |
| Offline scan | Restarts into a special environment to remove malware that hides while Windows runs. |
| Controlled folder access | An optional ransomware shield: only trusted apps may change your Documents, Pictures and other protected folders. |
| Tamper Protection | Stops other programs (and malware) from turning Defender off or changing its key settings. |
| SmartScreen | Warns about unknown downloads and bad sites based on reputation (Section 9 shows how this ties to signatures). |
Windows tip: If you ever see "Real-time protection is off", it may be switched off by you, turned off temporarily, or because another antivirus took over. Do not leave it off. Windows will turn it back on after a short time if you disable it temporarily.
6.2 Signature-Based vs Behavior-Based Detection
Defender uses several ways to decide "is this bad?". None is perfect alone, so it combines them.
1. Signature-based detection (known bad). A signature is a fingerprint or pattern that matches known malware: a hash of the whole file, or a distinctive chunk of bytes or code. Defender keeps a big database of them, updated several times a day through Windows Update ("security intelligence updates").
| Strength | Weakness |
|---|---|
| Fast and very accurate for known malware | Cannot catch brand-new malware |
| Few false alarms | Easy for attackers to dodge by changing a few bytes (obfuscation, packing) |
2. Heuristic and machine-learning detection (looks suspicious). Defender examines a file's structure and features and asks "does this look like malware, even if I never saw this exact file?" Machine-learning models trained on huge numbers of samples score the file.
3. Behavior-based detection (acts suspicious). Instead of how the file looks, Defender watches what a program does while it runs. Examples of suspicious behaviour:
- Quickly encrypting hundreds of files (ransomware)
- Injecting code into another process
- Starting a script that downloads a program and runs it
- Trying to read the memory of the sign-in process (credential theft, Section 8)
If the behaviour crosses a line, Defender stops the process, even if the file itself looked innocent. This catches new attacks and fileless malware (which lives in memory or uses built-in tools like PowerShell, and leaves no obvious file to scan).
4. AMSI (Antimalware Scan Interface). Scripts (PowerShell, VBScript, and others) can be scrambled on disk, but they must turn into plain code just before running. AMSI lets the script engine hand that plain code to Defender for a check at that moment.
| Method | Catches | Misses |
|---|---|---|
| Signatures | Known malware, quickly | New and altered malware |
| Heuristics / ML | New malware that resembles old | Very unusual or carefully crafted code |
| Behavior | Attacks in progress, fileless attacks | Slow, quiet, very careful attackers |
| AMSI | Scrambled scripts at run time | Malware that avoids scripts |
False positives. Any detector sometimes blocks a harmless file ("false positive"). If you are sure, you can restore it or add an exclusion. Use exclusions sparingly: attackers love folders that antivirus ignores.
6.3 Cloud-Delivered Protection
What it is: The signature database on your PC is limited in size and only as fresh as the last update. Cloud-delivered protection (also called cloud protection or MAPS, Microsoft Active Protection Service) lets Defender ask Microsoft's servers about a file it is unsure about, in seconds.
Defender finds an unknown file
│ sends a fingerprint (and, with your consent, maybe the file)
▼
┌──────────────────────────────────────┐
│ Microsoft cloud: huge database, │
│ machine learning, results from │
│ millions of PCs │
└──────────────────┬───────────────────┘
│ answer: safe / bad / unknown
▼
Defender blocks or allows
Benefits:
| Benefit | Why it helps |
|---|---|
| Speed | A new threat seen on one PC can protect everyone within minutes |
| Bigger brain | Cloud models are far larger than anything stored locally |
| Smaller local load | Less data to keep on your PC |
Related settings in Windows Security → Virus & threat protection → Manage settings:
| Setting | Meaning |
|---|---|
| Cloud-delivered protection | Ask the cloud about suspicious files |
| Automatic sample submission | Send suspicious files to Microsoft for analysis (may ask before sending files likely to contain personal data) |
| Tamper Protection | Locks key Defender settings |
| Controlled folder access | Optional ransomware shield |
Privacy note. Cloud protection sends file fingerprints and sometimes samples. You can see and change the settings above. Organisations often set these by policy.
Check it from PowerShell:
Get-MpComputerStatus # shows AMServiceEnabled, RealTimeProtectionEnabled,
# AntivirusSignatureLastUpdated, IsTamperProtected ...Handy fields: RealTimeProtectionEnabled (True is good), AntivirusSignatureLastUpdated (should be recent), IsTamperProtected, and AMRunningMode (Normal, or Passive if another antivirus is active). Some field names differ between Windows versions.
No tool is magic. Antivirus is one layer. Keep Windows updated, use a standard (non-admin) account for daily work, and be careful with downloads and attachments.
Summary
| Term | Plain meaning |
|---|---|
| Microsoft Defender Antivirus | The built-in antivirus engine |
| Windows Security | The app where you see and control all protection |
| Real-time protection | Scan files as they are used |
| Quarantine | A locked folder where detected files cannot run |
| Signature | A fingerprint or pattern of known malware |
| Heuristic / ML | Judges whether a file looks like malware |
| Behavior-based | Watches what a running program does |
| AMSI | Lets Defender see scripts in plain form just before they run |
| Cloud-delivered protection | Asks Microsoft's cloud about unknown files |
| Tamper Protection | Stops others from switching Defender off |
| SmartScreen | Reputation check for downloads and sites |
Get-MpComputerStatus | PowerShell view of Defender's state |