Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Advanced Technologies at the Core of Microsoft Defender Antivirus - Microsoft Defender for Endpoint | Microsoft Learn

13 October 2026Doc update+9 / −9 lines

In brief

The page title and description were refined, and explanations of real-time protection, hybrid detection, cloud protection, and detection engines were reworded for clarity. The description now highlights client and cloud engines, machine learning, and behavior monitoring.

What Defender admins need to know

Administrators get clearer context on how Defender Antivirus technologies support real-time threat detection.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Advanced technologiesTechnologies at the coreCore of Microsoft Defender Antivirus - Microsoft Defender for Endpoint | Microsoft Learn

Microsoft Defender Antivirus and the multiple engines that lead to the advanced detection and prevention technologies under the hood to detect and stop a wide range of threats and attacker techniques at multiple points, as depicted in the following diagram:

These next-generation protection engines provide industry-best detection and blocking capabilities and ensure that protection is:

  • Accurate: Threats both common and sophisticated, many which are designed to try to slip through protections, are detected and blocked.
  • Real-time: Threats are prevented from getting on to devices, stopped in real-time at first sight, or detected and remediated in the least possible time (typically withintime, typically in a few milliseconds).milliseconds.
  • Intelligent: Through the power of the cloud, machine learning (ML), and Microsoft's industry-leading optics, protection is enriched and made even more effective against new and unknown threats.

Hybrid detection and protection

Microsoft Defender Antivirus does hybrid detection and protection. What this means is, detectionDetection and protection occur on the client device first,first and works with the cloud for newly developing threats, which results in faster, more effective detection and protection.

When the client encounters unknown threats, it sends metadata or the file itself to the cloud protection service, where moreservice. More advanced protections examine new threats on the fly and integrate signals from multiple sources.

On the client In the cloud
Machine learning (ML) engine A set of light-weight machine learning models make a verdict within milliseconds. These models include specialized models and features that are built for specific file types commonly abused by attackers. Examples include models built for portable executable (PE) files, PowerShell, Office macros, JavaScript, and PDF files, and more.files. Metadata-based ML engine Specialized ML models, whichmodels analyze a featurized description of suspicious files sent by the client. These models include file type-specific models, feature-specific models, and adversary-hardened monotonic models, analyze a featurized description of suspicious files sent by the client.. Stacked ensemble classifiers combine results from these models to make a real-time verdict to allow or block files pre-execution.
Behavior monitoring engine The behavior monitoring engine monitors for potential attacks post-execution. It observes process behaviors, including behavior sequence at runtime, to identify and block certain types of activities based on predetermined rules. Behavior-based ML engine Suspicious behavior sequences and advanced attack techniques are monitored on the client as triggers to analyze the process tree behavior using real-time cloud ML models. Monitored attack techniques span the attack chain, from exploits, elevation, and persistence all the way through to lateral movement and exfiltration.
Memory scanning engine This engine scans the memory space used by a running process to expose malicious behavior that could be hiding through code obfuscation. Antimalware Scan Interface (AMSI)-paired ML engine Pairs of client-side and cloud-side models perform advanced analysis of scripting behavior pre- and post-execution to catch advanced threats like fileless and in-memory attacks. These models include a pair of models for each of the scripting engines covered, including PowerShell, JavaScript, VBScript, and Office VBA macros. Integrations include both dynamic content calls and/orand behavior instrumentation on the scripting engines.
AMSI integration engine Deep in-app integration engine enables detection of fileless and in-memory attacks through AMSI, defeating code obfuscation. This integration blocks malicious behavior of scripts client-side. File classification ML engine Multi-class, deep neural network classifiers examine full file contents, which provides an extra layer of defense against attacks that require more analysis. Suspicious files are held from running and submitted to the cloud protection service for classification. Within seconds, full-content deep learning models produce a classification and reply to the client to allow or block the file.
Heuristics engine Heuristic rules identify file characteristics that have similarities with known malicious characteristics to catch new threats or modified versions of known threats. Detonation-based ML engine Suspicious files are detonated in a sandbox. Deep learning classifiers analyze the observed behaviors to block attacks.
Emulation engine The emulation engine dynamically unpacks malware and examines how they would behave at runtime. The dynamic emulation of the content and scanning both the behavior during emulation and the memory content at the end of emulation defeat malware packers and expose the behavior of polymorphic malware. Reputation ML engine Domain-expert reputation sources and models from across Microsoft are queried to block threats that are linked to malicious or suspicious URLs, domains, emails, and files. Sources include Windows Defender SmartScreen for URL reputation models and Defender for Office 365 for email attachment expert knowledge, among other Microsoft services through the Microsoft Intelligent Security Graph.
Network engine Network activities are inspected to identify and stop malicious activities from threats. Smart rules engine Expert-written smart rules identify threats based on researcher expertise and collective knowledge of threats.