Test behavior monitoring in Microsoft Defender Antivirus

Behavior monitoring in Microsoft Defender Antivirus monitors applications, services, files, and processes for suspicious activity. Use the demonstrations in this article to confirm that behavior monitoring blocks known test behaviors on Windows or macOS and records the resulting detections.

Prerequisites

• Use a supported Windows or macOS device. For supported operating systems and onboarding requirements, see Minimum requirements for Microsoft Defender for Endpoint.
• On Windows, verify that real-time protection is enabled and query the behavior monitoring status.
• On macOS, complete the behavior monitoring prerequisites, and then verify that behavior monitoring is enabled.
• To review the resulting alert in the Microsoft Defender portal, the device must be onboarded to Defender for Endpoint.

Test behavior monitoring on Windows

Use the Windows demonstration to confirm that behavior monitoring blocks the test behavior and records the detection.

Run the Windows test command

Open PowerShell and run the following Microsoft behavior-monitoring test command:

powershell.exe -NoExit -Command "powershell.exe hidden 12154dfe-61a5-4357-ba5a-efecc45c34c4"

PowerShell returns an expected CommandNotFoundException:

hidden : The term 'hidden' is not recognized as the name of a cmdlet, function, script, script file, or operable program.  Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+hidden 12154dfe-61a5-4357-ba5a-efecc45c34c4
+""""""
CategoryInfo             : ObjectNotFound: (hidden:String) [], CommandNotFoundException
FullyQualifiedErrorId : CommandNotFoundException

Review the Windows detection

Open the Windows Security app, select Virus & threat protection, and then select Protection history. For detailed instructions, see Review threat detection history in the Windows Security app.

The detection displays the threat name Behavior:Win32/BmTestOfflineUI with a blocked or removed status. The detection details resemble the following output:

Threat blocked
Detected: Behavior:Win32/BmTestOfflineUI
Status: Removed
A threat or app was removed from this device.
Date: 6/7/2024 11:51 AM
Details: This program is dangerous and executes command from an attacker.
Affected items:
behavior: process: C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe, pid:6132:118419370780344
process: pid:6132,ProcessStart:133621698624737241
Learn more    Actions

On the Alerts page in the Microsoft Defender portal at https://security.microsoft.com/alerts, look for an alert titled Suspicious 'BmTestOfflineUI' behavior was blocked.

Open the alert to review the detection tree and the message Defender detected and terminated active 'Behavior:Win32/BmTestOfflineUI' in process 'powershell.exe' during behavior monitoring. For information about reviewing alerts, see Investigate alerts in Microsoft Defender for Endpoint.

Test behavior monitoring on macOS

To confirm that behavior monitoring blocks the macOS test behavior and records the detection, follow these steps:

1. In a text editor, create a Bash script with the following content:

   #! /usr/bin/bash
   echo " " >> /tmp/9a74c69a-acdc-4c6d-84a2-0410df8ee480.txt
   echo " " >> /tmp/f918b422-751c-423e-bfe1-dbbb2ab4385a.txt
   sleep 5
   

2. Save as BM_test.sh.

3. Run the following command to make the bash script executable:

   sudo chmod u+x BM_test.sh
   

4. Run the bash script:

   sudo bash BM_test.sh
   

   The terminal reports that the process was killed. For example:

   zsh: killed sudo bash BM_test.sh

5. Run the following command to confirm that Defender for Endpoint quarantined the test file and recorded the threat:

   mdatp threat list
   

   The result includes the threat name Behavior: MacOS/MacOSChangeFileTest, the type behavior, and the status quarantined, as shown in the following example:

   ID: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
   
   Name: Behavior: MacOS/MacOSChangeFileTest
   
   Type: "behavior"
   
   Detection time: Tue May 7 20:23:41 2024
   
   Status: "quarantined"
   

6. If the device is onboarded to Microsoft Defender for Endpoint Plan 1, Plan 2, or Microsoft Defender for Business, go to the Alerts page in the Microsoft Defender portal at https://security.microsoft.com/alerts. Look for an alert titled Suspicious 'MacOSChangeFileTest' behavior was blocked.

   For information about reviewing the alert, see Investigate alerts in Microsoft Defender for Endpoint.