New Update Security Intelligence Updates in Microsoft Defender (Threat Detection Changelog)

[simmerskool]

W11 Pro. Enable beta channel via GPO or Powershell command.

"stuck" with win10 unless I buy some hardware. thanks!

 

[oldschool]

"stuck" with win10 unless I buy some hardware. thanks!

You can still enable the Beta channel.

 

[oldschool]

Beta channel update

Antimalware Client Version: 4.18.25030.2

 

[oldschool]

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

March-2025 (Engine 1.1.25030.1)

Security intelligence update version: 1.427.3.0
Release date: April 1, 2025 (Engine only)
Platform: 4.18.25020.1009
Engine: 1.1.25030.1
Support phase: Security and Critical Updates

What's new

Product improvements

 

[Fel Grossi]

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

Manage how Microsoft Defender Antivirus receives protection and product updates.

learn.microsoft.com

March-2025 (Platform: 4.18.25030.2 | Engine 1.1.25030.1)​

• Security intelligence update version: 1.427.3.0
• Release date: April 1, 2025 (Engine) / April 9, 2025 (Platform)
• Platform: 4.18.25030.2
• Engine: 1.1.25030.1
• Support phase: Security and Critical Updates

What's new​

• Improved caching of device control settings to improve reliability in occasionally connected environments.
• Performance improvement in on-access scans of files in network locations.
• Fixed the Defender service description to match the latest installed version.
• Improved Defender engine update logic when the update is included in a custom image.
• Fix in health reporting where signature update data might have been incorrect.
• Fixed reporting issue with controlled folder access (CFA) protected folders using the PowerShell cmdlet Get-MpPreference when CFA is disabled.
• Improved performance when scanning UPX-packed files (Ultimate Packer for eXecutables) and updated the validation process to verify the integrity of the packed file itself.
• Added support for distinguishing regular cloud allow signatures from clean Indicators of Compromise (IoC) in attack surface reduction (ASR).

 

[oldschool]

Beta channel update to

Engine Version: 1.1.25040.1

 

[TairikuOkami]

4.18.25040.2

https://download.windowsupdate.com/c/msdownload/update/software/defu/2025/04/updateplatform.amd64fre_8ed5fc344b6f5d307f0dec682298e9a2d8469e9f.exe

 

[oldschool]

4.18.25040.2

https://download.windowsupdate.com/c/msdownload/update/software/defu/2025/04/updateplatform.amd64fre_8ed5fc344b6f5d307f0dec682298e9a2d8469e9f.exe

Yes, that's the latest platform version I show on beta channel. AFAIK the stable channel hasn't caught up, at least according to release notes.
Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

 

[oldschool]

April-2025 (Platform: TBD | Engine: 1.1.25040.1)

• Security intelligence update version: 1.429.3.0
• Release date: May 14, 2025 (Engine) / (Platform pending)
• Platform: (coming soon)
• Engine: 1.1.25040.1
• Support phase: Security and Critical Updates

What's new​

• Fixed TVM Block where we failed to block a trusted file
• Fixed Microsoft Defender platform update timestamp to reflect the actual update time.
• The 1002 event (An anti-malware scan was stopped before it finished) now includes details of the stop reason.
• Added more details to the 1000 event (Scan started), like scan trigger and scan on idle.
• Improved ASR file processing to correctly handle "allow" Indicators of Compromise (IoCs).
• Improvement in health reporting for machines that are rebooted or hibernated.
• Improved performance for Smart App Control (SAC) trusted file handling.
• Improved device control logic for offline printers.

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

 

[oldschool]

Beta Engine Version: 1.1.25050.2

 

[Parkinsond]

April-2025 (Platform: TBD | Engine: 1.1.25040.1)

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

In events log, I found SAC blocking some Windows dll files!

 

[oldschool]

In events log, I found SAC blocking some Windows dll files!

Indeed, SAC will block some MS stuff, but they are usually (?) harmless. They're famous for using unsigned dlls. Hey, it's their OS, they can do what they want.

 

[Parkinsond]

Indeed, SAC will block some MS stuff, but they are usually (?) harmless. They're famous for using unsigned dlls. Hey, it's their OS, they can do what they want.

friendly fire

 

[oldschool]

Beta Platform updated to Antimalware Client Version: 4.18.25050.2

 

[oldschool]

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint
New platform update (Stable release channel)

• Security intelligence update version: 1.429.3.0
• Release date: May 14, 2025 (Engine) / May 22, 2025 (Platform)
• Platform: 4.18.25040.2
• Engine: 1.1.25040.1
• Support phase: Security and Critical Updates

Beta channel platform update: Antimalware Client Version: 4.18.25050.5

 

[oldschool]

Beta channel Engine Version: 1.1.25050.6 released.

 

[oldschool]

Beta channel updated to:

• Antimalware Client Version: 4.18.25060.2 (Platform)
• Engine Version: 1.1.25060.3

 

[oldschool]

May-2025 (Platform: 4.18.25050.5 | Engine: 1.1.25050.6)​

• Security intelligence update version: 1.431.19.0
• Release date: June 13, 2025 (Engine) / June 13, 2025 (Platform)
• Platform: 4.18.25050.5
• Engine: 1.1.25050.6
• Support phase: Security and Critical Updates

What's new​

• Windows multisession SKUs are now properly classified as client SKUs for signature versioning
• EnableDynamicSignatureDroppedEventReporting configuration is now available in Intune (see Event ID 2011)
• The display name and description is now displayed correctly for the device control filter driver in Windows services
• Improved performance for kernel driver
• Improvements to network protection performance related to packet loss during high network utilization
• Reliability improvements to network protection during service shutdown
• Enriched Event ID 1000 to include ScanOnlyIfIdle and scan priority
• Improved device control Windows Portal Device (WPD) device discovery in File explorer. (For more information about device control, see Device control policy samples and scenarios.)
• Resolved discrepancy in device health reports between signature publish and signature install date and time
• Performance improvements when scanning files/folders with extended attributes
• Reliability improvement in the Defender kernel driver to avoid crashing when there's excessive disk input/output
• Added exponential backoff support to Core Service 1DS manager telemetry module to address memory consumption and DNS flooding issues

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

Manage how Microsoft Defender Antivirus receives protection and product updates.

learn.microsoft.com

 

[Parkinsond]

• Improvements to network protection performance related to packet loss during high network utilization

Does using network protection frequently lead to packet loss; is it recommended to turn off for saving bandwidth?

 

[Allego]

Does using network protection frequently lead to packet loss; is it recommended to turn off for saving bandwidth?

Both are No IMO