Does Windows Defender scan MSI files?

Question

Does Windows Defender scan MSI files?

James Griffiths 1

So recently since using Intune and Defender for Endpoint we have noticed that when we create a wrapped MSI file with an exe inside it that it appears that something is scanning and running the file to see what it is? I appears to be ran by a low spec windows 10 VM so I'm thinking this is some sort of cloud sandbox that would do this?

I cant seem to find any logs on either local machines or 365 to say that this is happening. It is very strange.

Has anyone else had this issue or know which setting in windows 10 baseline etc that i would need to change to stop this from happening.

James Griffiths 1 Reputation point

2022-03-31T09:01:39.897+00:00

just to add to this the reason for asking is that by something running the files to scan it onboards into our systems, hence wanting to find out what's causing it.
Lu Dai-MSFT 28,191 Reputation points

2022-04-01T01:32:52.497+00:00

@James Griffiths Thanks for posting in our Q&A. For this issue, it is more related to Defender for Endpoint. To get more accurate help, it is suggested to contact Microsoft Defender for Endpoint support. Here is the support link:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/contact-support?view=o365-worldwide

Hope everything goes well with you.

James Griffiths 1 Reputation point

2022-03-31T09:01:39.897+00:00

just to add to this the reason for asking is that by something running the files to scan it onboards into our systems, hence wanting to find out what's causing it.
Lu Dai-MSFT 28,191 Reputation points

2022-04-01T01:32:52.497+00:00

@James Griffiths Thanks for posting in our Q&A. For this issue, it is more related to Defender for Endpoint. To get more accurate help, it is suggested to contact Microsoft Defender for Endpoint support. Here is the support link:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/contact-support?view=o365-worldwide

Hope everything goes well with you.

Answer 1

Reza-Ameri 16,601

Microsoft Anti-Malware engine including Microsoft Defender will scan inside compress and MSI files. However, to check if Microsoft Defender is really causing this issue or not, you may try disable the Microsoft Defender and see if the problem persist?

Does Windows Defender scan MSI files?

1 answer

Activity