Windows 10 - When does Windows Defender run when writing files to disk

Question

When writing files to a file system from a database, does real time protection from Windows Defender stop a file from being written to the disk if malware or a virus is detected? Or does it fully write the file to the file system first, scan it, then remove the file if issues are found?

Answer 1

Note: This is my understanding, not an expert answer based upon source code.

File system scanning would occur after the file is written to disk but before it is accessible. Otherwise the file would have to be loaded into memory or partially scanned as it is being written. While I've never looked I suspect the virtual file filter driver used by AV is probably one of the last filters to run so it can catch malware that might have installed themselves in the kernel somehow.

But in addition to file scanning AV tools like defender also have memory components that are running so there is protection for in-memory malware that might never use the file system.

Answer 2

Hi

The Microsoft Defender Antivirus engine makes note of any file changes (file writes, such as moves, copies, or modifications) and general program activity (programs that are opened or running and that cause other programs to run).

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus?view=o365-worldwide#enable-and-configure-always-on-protection-in-group-policy

Best Regards

--please don't forget to Accept as answer if the reply is helpful--