An unexpected journey into Microsoft Defender’s signature world

Microsoft Defender is the endpoint security solution preinstalled on every Windows machine since Windows 7. It’s a fairly complex piece of software, addressing both EDR and EPP use cases. As such, Microsoft markets two different products. Microsoft Defender for Endpoint is a cloud based endpoint security solution that combines sensor capabilities with the advantages of a cloud processing. Microsoft Defender Antivirus (MDA), on the other hand, is a modern EPP enabled by default on any fresh Windows installation. MDA is the focus of this analysis.
↫ Retooling

If you’ve ever wanted to know how Microsoft Defender works, this article contains a wealth of detailed information.