Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint (2024)

Applies to:

• Microsoft Defender for Endpoint Plans 1 and 2
• Microsoft Defender Antivirus

Platforms

• Windows

Keeping Microsoft Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. Update your antivirus protection, even if Microsoft Defender Antivirus is running in passive mode. This article includes information about the two types of updates for keeping Microsoft Defender Antivirus current:

• Security intelligence updates
• Product updates

This article also includes:

• Microsoft Defender Antivirus platform support
• How to roll back an update (if necessary)
• Platform version included with Windows 10 releases
• Updates for Deployment Image Servicing and Management (DISM)

Security intelligence updates

Microsoft Defender Antivirus uses cloud-delivered protection (also called the Microsoft Advanced Protection Service, or MAPS) and periodically downloads dynamic security intelligence updates to provide more protection. These dynamic updates don't take the place of regular security intelligence updates via security intelligence update KB2267602.

Cloud-delivered protection is always on and requires an active connection to the Internet to function. Security intelligence updates occur on a scheduled cadence (configurable via policy). For more information, see Use Microsoft cloud-provided protection in Microsoft Defender Antivirus.

For a list of recent security intelligence updates, see Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware.

Engine updates are included with security intelligence updates and are released on a monthly cadence.

Product updates

Microsoft Defender Antivirus requires monthly updates (KB4052623) known as platform updates.

You can manage the distribution of updates through one of the following methods:

• Windows Server Update Service (WSUS)
• Microsoft Configuration Manager
• The usual methods you use to deploy Microsoft and Windows updates to endpoints in your network.

For more information, see Manage the sources for Microsoft Defender Antivirus protection updates.

Important points about product updates

• Monthly updates are released in phases, resulting in multiple packages visible in your Window Server Update Services.

• This article lists changes that are included in the broad release channel. See the latest broad channel release here.

• To learn more about the gradual rollout process, and to see more information about the next release, see Manage the gradual rollout process for Microsoft Defender updates.

• To learn more about security intelligence updates, see Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware.

• If you're looking for a list of Microsoft Defender processes, see the spreadsheet provided at Enable access to Microsoft Defender for Endpoint service URLs in the proxy server. The sheet also lists the services and their associated URLs that your network must be able to connect to.

• Platform updates can be temporarily postponed if other protection features, such as Endpoint DLP or Device Control are actively monitoring running processes. Platform updates are retried after a reboot or when all monitored services are stopped.

• In the Microsoft Endpoint Configuration Manager / Windows Server Update Services (MECM/WSUS) catalog, the category Microsoft Defender for Endpoint includes updates for the MSSense service in KB5005292. KB5005292 includes updates and fixes to the Microsoft Defender for Endpoint endpoint detection and response (EDR) sensor. For more information, see Microsoft Defender for Endpoint update for EDR Sensor and What's new in Microsoft Defender for Endpoint on Windows.

Monthly platform and engine versions

All our updates contain

• Performance improvements
• Serviceability improvements
• Integration improvements (Cloud, Microsoft Defender XDR)

May-2024 (Engine: 1.1.24050.5 | Platform: 4.18.24050.7)

• Security intelligence update version: 1.413.1.0
• Release date: May 30, 2024 (Engine) / June 4, 2024 (Platform)
• Engine: 1.1.24050.5
• Platform: 4.18.24050.7
• Support phase: Security and Critical Updates

What's new

• Improved performance when running configuration queries.
• Optimized how scans are prioritized.
• Fixed a crash caused by a race condition with a device control driver.
• Added Event Viewer Logging for scan start event where the scan originates from Powershell.

April-2024 (Engine: 1.1.24040.1 | Platform: 4.18.24040.4)

• Security intelligence update version: 1.411.7.0
• Release date: May 07, 2024 (Engine) / May 16, 2024 (Platform)
• Engine: 1.1.24040.1
• Platform: 4.18.24040.4
• Support phase: Security and Critical Updates

What's new

• Added an opt-out feature for Experimental Configuration Services (ECS) and One collector in the Core Service.
• Fixed an issue where occasionally exclusions deployed via Intune were not being honored when tamper protection was enabled.
• After a new engine version is released, support for older versions (N-2) will now reduce to technical support only. Engine versions older than N-2 are no longer supported.
• Improved health monitoring and telemetry for Attack Surface Rules exclusions.
• Updated inaccurate information in Configure exclusions for files opened by processes regarding wildcard usage with contextual exclusions.

March-2024 (Engine: 1.1.24030.4 | Platform: 4.18.24030.9)

• Security intelligence update version: 1.409.1.0
• Release date: April 2, 2024 (Engine) / April 9, 2024 (Platform)
• Engine: 1.1.24030.4
• Platform: 4.18.24030.9
• Support phase: Security and Critical Updates

What's new

• Added manageability settings to opt out for One Collector telemetry channel and Experimentation and Configuration Service (ECS).
• Microsoft Defender Core Service will be disabled when 3rd party Antivirus is installed (except when Defender for Endpoint is running in Passive mode).
• The known issue in 4.18.24020.7 where enforcement of device level access policies wasn't working as expected no longer occurs.
• Fixed high CPU issue caused by redetection done during Sense originating scans.
• Fixed an issue with Security Intelligence Update disk cleanup.
• Fixed an issue where the Signature date information on the Security Health report wasn't accurate.
• Introduced performance improvements when processing paths for exclusions.
• Added improvements to allow recovering from erroneously added Indicators of compromise (IoC).
• Improved resilience in processing attack surface reduction exclusions for Anti Malware Scan Interface (AMSI) scans.
• Fixed a high memory issue related to the Behavior Monitoring queue that occurred when MAPS is disabled.
• A possible deadlock when receiving a Tamper protection configuration change from the Microsoft Defender portal no longer occurs.

Previous version updates: Technical upgrade support only

After a new package version is released, support for the previous two versions is reduced to technical support only. For more information about previous versions, see Microsoft Defender Antivirus updates: Previous versions for technical upgrade support.

Microsoft Defender Antivirus platform and engine support

Platform and engine updates are provided on a monthly cadence. To be fully supported, keep current with the latest platform and engine updates. Our support structure is dynamic, evolving into two phases depending on the availability of the latest platform and engine version:

• Security and Critical Updates servicing phase - When running the latest platform and engine version, you're eligible to receive both Security and Critical updates to the anti-malware platform.

• Technical Support (Only) phase - After a new platform and engine version is released, support for older versions (N-2) reduce to technical support only. Platform and engine versions older than N-2 are no longer supported. Technical support continues to be provided for upgrades from the Windows 10 release version (see Platform version included with Windows 10 releases) to the latest platform version.

During the technical support (only) phase, commercially reasonable support incidents are provided through Microsoft Customer Service & Support and Microsoft's managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a nonsecurity update, or requires a security update, customers are asked to upgrade to the latest platform version or an intermediate update (*).

How to roll back an update

In the unfortunate event that you encounter issues after a platform update, you can roll back to the previous or the inbox version of the Microsoft Defender platform.

• To roll back to the previous version, run the following command:

  "%programdata%\Microsoft\Windows Defender\Platform\<version>\MpCmdRun.exe" -RevertPlatform

• To roll back this update to the version shipped with the Operating System ("%ProgramFiles%\Windows Defender")

  "%programdata%\Microsoft\Windows Defender\Platform\<version>\MpCmdRun.exe" -ResetPlatform

Platform version included with Windows 10 releases

The below table provides the Microsoft Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases:

For Windows 10 release information, see the Windows lifecycle fact sheet.

Updates for Deployment Image Servicing and Management (DISM)

To avoid a gap in protection, keep your OS installation images up to date with the latest antivirus and antimalware updates. Updates are available for:

• Windows 10 and 11 (Enterprise, Pro, and Home editions)
• Windows Server 2022, Windows Server 2019, Windows Server 2016, and Windows Server 2012 R2
• WIM and VHD(x) files

Updates are released for x86, x64, and ARM64 Windows architecture.

For more information, see Microsoft Defender update for Windows operating system installation images.

1.411.111.0

• Defender package version: 1.411.111.0
• Security intelligence version: 1.411.111.0
• Engine version: 1.24050.2
• Platform version: 4.18.24050.7

Fixes

• None

Additional information

• None

1.411.9.0

• Defender package version: 1.411.9.0
• Security intelligence version: 1.411.9.0
• Engine version: 1.24040.1
• Platform version: 4.18.24040.4

Fixes

• None

Additional information

• None

20230809.1

• Defender package version: 20230809.1
• Security intelligence version: 1.395.68.0
• Engine version: 1.1.23070.1005
• Platform version: 4.18.23070.1004

Fixes

• None

20230604.1

• Defender package version: 20230604.1
• Security intelligence version: 1.391.476.0
• Engine version: 1.1.23050.3
• Platform version: 4.18.23050.3

Fixes

• None

20230503.1

• Defender package version: 20230503.1
• Security intelligence version: 1.389.44.0
• Engine version: 1.1.20300.3
• Platform version: 4.18.2304.8

Fixes

• None

Additional information

• None

20230330.2

• Defender package version: 20230330.2
• Security intelligence version: 1.385.1537.0
• Engine version: 1.1.20100.6
• Platform version: 4.18.2302.7

Fixes

• None

Additional information

• None

20230308.1

• Defender package version: 20230308.1
• Security intelligence version: 1.383.1321.0
• Engine version: 1.1.20000.2
• Platform version: 4.18.2301.6

Fixes

• None

Additional information

• None

20230215.1

• Defender package version: 20230215.1
• Security intelligence version: 1.383.51.0
• Engine version: 1.1.20000.2
• Platform version: 4.18.2301.6

Fixes

• None

Additional information

• None

20230118.1

• Defender package version: 20230118.1
• Security intelligence version: 1.381.2404.0
• Engine version: 1.1.19900.2
• Platform version: 4.18.2211.5

Fixes

• None

Additional information

• None

20221209.1

• Defender package version: 20221209.1
• Security intelligence version: 1.381.144.0
• Engine version: 1.1.19900.2
• Platform version: 4.18.2211.5

Fixes

• None

Additional information

• None

20221102.3

• Defender package version: 20221102.3
• Security intelligence version: 1.377.1180.0
• Engine version: 1.1.19700.3
• Platform version: 4.18.2210.4

Fixes

• None

Additional information

• None

20221014.1

• Package version: 20221014.1
• Platform version: 4.18.2209.7
• Engine version: 1.1.19700.3
• Signature version: 1.373.208.0

Fixes

• None

Additional information

• None

20220929.1

• Package version: 20220929.1
• Platform version: 4.18.2207.7
• Engine version: 1.1.19600.3
• Signature version: 1.373.1243.0

Fixes

• None

Additional information

• None

20220925.2

• Package version: 20220925.2
• Platform version: 4.18.2207.7
• Engine version: 1.1.19600.3
• Signature version: 1.373.1371.0

Fixes

• None

Additional information

• None

20220901.4

• Package version: 20220901.4
• Platform version: 4.18.2205.7
• Engine version: 1.1.19500.2
• Signature version: 1.373.1371.0

Fixes

• None

Additional information

• None

20220802.1

• Package version: 20220802.1
• Platform version: 4.18.2205.7
• Engine version: 1.1.19400.3
• Signature version: 1.371.1205.0

Fixes

• None

Additional information

• None

20220629.5

• Package version: 20220629.5
• Platform version: 4.18.2205.7
• Engine version: 1.1.19300.2
• Signature version: 1.369.220.0

Fixes

• None

Additional information

• None

20220603.3

• Package version: 20220603.3
• Platform version: 4.18.2203.5
• Engine version: 1.1.19200.6
• Signature version: 1.367.1009.0

Fixes

• None

Additional information

• None

20220506.6

• Package version: 20220506.6
• Platform version: 4.18.2203.5
• Engine version: 1.1.19200.5
• Signature version: 1.363.1436.0

Fixes

• None

Additional information

• None

20220321.1

• Package version: 20220321.1
• Platform version: 4.18.2202.4
• Engine version: 1.1.19000.8
• Signature version: 1.351.337.0

Fixes

• None

Additional information

• None

20220305.1

• Package version: 20220305.1
• Platform version: 4.18.2201.10
• Engine version: 1.1.18900.3
• Signature version: 1.359.1405.0

Fixes

• None

Additional information

• None

20220203.1

• Package version: 20220203.1
• Platform version: 4.18.2111.5
• Engine version: 1.1.18900.2
• Signature version: 1.357.32.0

Fixes

• None

Additional information

• None

20220105.1

• Package version: 20220105.1
• Platform version: 4.18.2111.5
• Engine version: 1.1.18800.4
• Signature version: 1.355.1482.0

Fixes

• None

Additional information

• None

1.1.2112.01

• Package version: 1.1.2112.01
• Platform version: 4.18.2110.6
• Engine version: 1.1.18700.4
• Signature version: 1.353.2283.0

Fixes

• None

Additional information

• None

1.1.2111.02

• Package version: 1.1.2111.02
• Platform version: 4.18.2110.6
• Engine version: 1.1.18700.4
• Signature version: 1.353.613.0

Fixes

• Fixed an issue pertaining to localization files

Additional information

• None

1.1.2110.01

• Package version: 1.1.2110.01
• Platform version: 4.18.2109.6
• Engine version: 1.1.18500.10
• Signature version: 1.349.2103.0

Fixes

• None

Additional information

• None

1.1.2109.01

• Package version: 1.1.2109.01
• Platform version: 4.18.2107.4
• Engine version: 1.1.18400.5
• Signature version: 1.347.891.0

Fixes

• None

Additional information

• None

1.1.2108.01

• Package version: 1.1.2108.01
• Platform version: 4.18.2107.4
• Engine version: 1.1.18300.4
• Signature version: 1.343.2244.0

Fixes

• None

Additional information

• None

1.1.2107.02

• Package version: 1.1.2107.02
• Platform version: 4.18.2105.5
• Engine version: 1.1.18300.4
• Signature version: 1.343.658.0

Fixes

• None

Additional information

• None

1.1.2106.01

• Package version: 1.1.2106.01
• Platform version: 4.18.2104.14
• Engine version: 1.1.18100.6
• Signature version: 1.339.1923.0

Fixes

• None

Additional information

• None

1.1.2105.01

• Package version: 1.1.2105.01
• Platform version: 4.18.2103.7
• Engine version: 1.1.18100.6
• Signature version: 1.339.42.0

Fixes

• None

Additional information

• None

1.1.2104.01

• Package version: 1.1.2104.01
• Platform version: 4.18.2102.4
• Engine version: 1.1.18000.5
• Signature version: 1.335.232.0

Fixes

• None

Additional information

• None

1.1.2103.01

• Package version: 1.1.2103.01
• Platform version: 4.18.2101.9
• Engine version: 1.1.17800.5
• Signature version: 1.331.2302.0

Fixes

• None

Additional information

• None

1.1.2102.03

• Package version: 1.1.2102.03
• Platform version: 4.18.2011.6
• Engine version: 1.1.17800.5
• Signature version: 1.331.174.0

Fixes

• None

Additional information

• None

1.1.2101.02

• Package version: 1.1.2101.02
• Platform version: 4.18.2011.6
• Engine version: 1.1.17700.4
• Signature version: 1.329.1796.0

Fixes

• None

Additional information

• None

1.1.2012.01

• Package version: 1.1.2012.01
• Platform version: 4.18.2010.7
• Engine version: 1.1.17600.5
• Signature version: 1.327.1991.0

Fixes

• None

Additional information

• None

1.1.2011.02

• Package version: 1.1.2011.02
• Platform version: 4.18.2010.7
• Engine version: 1.1.17600.5
• Signature version: 1.327.658.0

Fixes

• None

Additional information

• Refreshed Microsoft Defender Antivirus signatures

1.1.2011.01

• Package version: 1.1.2011.01
• Platform version: 4.18.2009.7
• Engine version: 1.1.17600.5
• Signature version: 1.327.344.0

Fixes

• None

Additional information

• None

1.1.2009.10

• Package version: 1.1.2011.01
• Platform version: 4.18.2008.9
• Engine version: 1.1.17400.5
• Signature version: 1.327.2216.0

Fixes

• None

Additional information

• Added support for Windows 10 RS1 or later OS install images.

More resources