New Update Security Intelligence Updates in Microsoft Defender (Threat Detection Changelog)

June-2025 (Platform: 4.18.25060.7 | Engine: 1.1.25060.6)
  • Security intelligence update version: 1.433.2.0
  • Release date: July 22, 2025 (Engine) / July 22, 2025 (Platform)
  • Platform: 4.18.25060.7
  • Engine: 1.1.25060.6
  • Support phase: Security and Critical Updates

What's new​

  • Added filtering to improve scan stability and prevent engine crashes
  • Additional performance improvements to prevent concurrent scans. This change ensures that if a quick or full scan is already running, no additional quick or full scan scans are initiated from MpCmdRun or Powershell (Start-Scan).
  • Resolved the issue where subfolder exclusions were not being honored in Microsoft Defender Antivirus scans related to non-Microsoft SIEM solutions. This fix ensures that specified subfolders are now correctly excluded from scans, preventing unnecessary detections and improving overall system performance.
Click to expand...
Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint
 
  • Like
  • +Reputation
Reactions: Idanox, simmerskool, Gandalf_The_Grey and 3 others
oldschool said:
June-2025 (Platform: 4.18.25060.7 | Engine: 1.1.25060.6)

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint
Click to expand...
  • Additional performance improvements to prevent concurrent scans. This change ensures that if a quick or full scan is already running, no additional quick or full scan scans are initiated from MpCmdRun or Powershell (Start-Scan).
Click to expand...
MD has a bug; if you start scan from file explorer context menu while quick or full scan was running, quick or full scan terminates prematurely.
 
  • Like
Reactions: oldschool
Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

July-2025 (Platform: 4.18.25070.5 | Engine: 1.1.25070.4)​

  • Security intelligence update version: 1.435.11.0
  • Release date: August 5, 2025 (Engine) / August 6, 2025 (Platform)
  • Platform: 4.18.25070.5
  • Engine: 1.1.25070.4
  • Support phase: Security and Critical Updates

What's new​

  • Enhanced Passive Mode Scanning Behavior When Microsoft Defender is in Passive mode, an Antivirus scan will not occur after a signature update , unless specifically set in the policy setting DisableScanOnUpdate.
  • Improved Tamper Protection Handling Optimized the configuration process for Tamper Protection in multi-threaded environments to ensure more reliable behavior.
  • Digital Signature Verification Performance Boost Enhanced the efficiency of digital signature verification to improve overall system performance.
  • Refined ASR Rule Exclusion Processing Refined exclusion processing and resolved false positives for the Attack Surface Reduction (ASR) rule: Block Office applications from injecting code into other processes.
Click to expand...
 
  • Like
  • +Reputation
Reactions: Fel Grossi, Allego, 1chaoticadult and 5 others
Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

August-2025 (Platform: 4.18.25080.5 | Engine: 1.1.25080.5)​

  • Security intelligence update version: 1.437.1.0
  • Release date: September 16, 2025 (Engine) / September 17, 2025 (Platform)
  • Platform: 4.18.25080.5
  • Engine: 1.1.25080.5
  • Support phase: Security and Critical Updates

  • What's new​

    Improved Defender update reliability by allowing non-admin processes to trigger shared signature updates, reducing unnecessary privilege requirements.
Click to expand...
 
  • +Reputation
  • Like
Reactions: Trident, Gandalf_The_Grey, simmerskool and 3 others
oldschool said:
Why block outbound connections for Defender?
Click to expand...
I set it to block all outbound (instead of default allow all outbound) and manually create allow rules for only necessary services and programs such svchost, MSD, SS, browser, and so on.
Changing the folder name with each update necessitates manually editing 3 rules for MSD.
 
  • Thanks
  • Like
Reactions: Trident and oldschool
Parkinsond said:
I set it to block all outbound (instead of default allow all outbound) and manually create allow rules for only necessary services and programs such svchost, MSD, SS, browser, and so on.
Changing the folder name with each update necessitates manually editing 3 rules for MSD.
Click to expand...
So you use the Beta channel, I presume?
 
  • Like
Reactions: Trident and Parkinsond
Parkinsond said:
No, the current channel; I do not know how to convert to the beta one?
Click to expand...
Use Group Policy or powershell.
Code: 
Set-MpPreference -PlatformUpdatesChannel Beta
or
Code: 
Set-MpPreference -EngineUpdatesChannel Beta -PlatformUpdatesChannel Beta
 
  • Like
  • +Reputation
  • Thanks
Reactions: Zartarra, Gandalf_The_Grey, Trident and 1 other person
oldschool said:
Use Group Policy or powershell.
Code: 
Set-MpPreference -PlatformUpdatesChannel Beta
or
Code: 
Set-MpPreference -EngineUpdatesChannel Beta -PlatformUpdatesChannel Beta
Click to expand...
Unfortunately I could not find any group policy for update channel, and PS did not work neither.
Capture.JPG
 

You may also like...