I got bored and decided to test Microsoft Defender, but I noticed something strange. When I downloaded several malicious EXE files, Microsoft Defender didn't block or quarantine them during the download. Instead, Defender only detected them after I actually ran or executed the files. I also noticed that VirusTotal showed Microsoft Defender detecting the threats, so the files were clearly being recognized as malicious by Defender's engine. Has Microsoft changed the way Defender detects malware? Does it now require a malicious file to be executed before it detects it, similar to how some behavioral detection works in Malwarebytes? Or should Defender still be detecting and blocking known malicious EXE files before they are executed?
My system is clean, and I even performed a clean installation of Windows. I also used ConfigureDefender with the settings configured to High, and all of the relevant protection settings appeared to be enabled.I'm trying to understand whether this is normal behavior with the current version of Microsoft Defender or if something might be misconfigured on my system. Before, Microsoft Defender would detect and block malicious files while they were being downloaded, before I had a chance to run or execute them. Now, however, it seems like Defender is allowing the files to finish downloading and only detects them after I execute them.
Hi, Defender should not generally require a known malicious EXE to execute before detecting it. What you observed can happen, but it does not by itself show that Microsoft changed Defender into execution-only protection. It more likely means the download did not trigger—or did not produce a verdict from—the expected file-scanning path, while access at execution did.
Why the timing can differ
VirusTotal is not a reliable prediction of what Defender on your PC must do at download time. Its Microsoft result may use a different signature or cloud state, scan the completed file later, and lack the same file origin and delivery context. A VirusTotal detection confirms recognition in that particular scan; it does not prove your local Defender had the same verdict when the download completed.
Defender has several opportunities to intervene: browser or reputation checks, scanning when a file is written or closed, later background scanning, and scanning when the file is opened or executed. Execution can therefore be the first moment at which Defender blocks a file without implying that only behavioral detection is active.
Also distinguish
the download finishing from
the payload running successfully. If launching it immediately produced a Defender alert and quarantine, Defender may have blocked access before meaningful execution. Protection History and Event Viewer are better evidence of the detection stage than the visible timing of the notification.
Checks that isolate the problem
Do not execute more live malware for testing. Use the harmless
EICAR test file or another vendor-provided test artifact, then change one variable at a time.
- Check Windows Security status directly. Under Virus & threat protection settings, confirm Real-time protection, Cloud-delivered protection and Automatic sample submission are enabled. Under App & browser control, check reputation-based protection as well; that layer is separate from antivirus scanning.
- Check exclusions and conflicts. Review Defender exclusions and confirm no other antivirus is registered. In PowerShell, `Get-MpComputerStatus` can show whether antivirus, real-time and behavior monitoring are enabled; `Get-MpPreference` can reveal exclusions and relevant scan preferences. Redact usernames and paths before posting output.
- Temporarily return ConfigureDefender to its Windows defaults, reboot, and repeat only the harmless test. “High” is a third-party policy preset, not proof that every local protection path is functioning. If defaults restore download-time detection, the preset or a resulting policy deserves inspection.
- Compare browsers with the same harmless test. If only one browser differs, its download handling or reputation integration becomes more likely. If all browsers behave identically, concentrate on Defender policy and service state.
- Examine Protection History and `Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational`. Note the detection time, action, file path and whether remediation occurred—never upload or share the malware itself.
If EICAR is detected when saved or extracted, but those samples were caught only when opened, that does not establish a general Defender failure; the individual files, archive/container handling, cloud verdict timing and delivery method matter. If EICAR also remains untouched until launch, despite real-time protection being reported active, that is strong evidence of a configuration or protection-path problem rather than normal expected behavior.
Practical conclusion
Defender still uses pre-execution scanning and reputation controls; execution is not supposed to be a universal prerequisite for detecting known malware. The precise cause here cannot be assigned from notification timing or VirusTotal alone.
Because live malicious files were executed, a clean installation performed afterward addresses that installation, but further live testing is an unnecessary gamble. If any sample ran before Defender intervened—or if there is doubt whether it did—disconnect that test system from sensitive accounts and use the MalwareTips Malware Removal Assistance team for individualized checking. A negative scan would not conclusively settle an actually executed sample.
& have 
or take a chill 
and watch cat videos on YouTube while AI detsroys the world.
