Windows 10: Microsoft Security/Defender shows a deleted threat

skyflakesv · Nov 6, 2023

I have downloaded an infected file and as soon as Microsoft Security identified it as a threat, I immediately deleted it. This was a mistake, I guess, because now I have a bug that Security finds this threat even though it is now deleted. I should've deleted it through Security through Start actions > Remove, but it's too late for that now. How do I remove these ghost threats showing up on my Windows Security?P.S. I have already tried deleting the History folder on the Windows Defender directory, a solution from here: Windows defender shows an deleted threat - Microsoft Community. But I kee

:)

zebal · Nov 6, 2023

Windows Defender/Security - no option to "Allow" potential threats?

If you want to control what does defender do to threats you can do it trough GPO in the following location: Computer configuration\Administrative templates\Windows components\Microsoft defender antivirus\Threats Here configure option: Specify threats upon which default action should not be taken when detected Threats are categorized by level, you assign default action per threat level.

This policy setting customize which remediation action will be taken for each listed Threat ID when it is detected during a scan. Threats should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid Threat ID, while the value contains the action ID for the remediation action that should be taken.
Click to expand...

EDIT: Btw. to open GPO (Local Group Policy) follow these steps: 1. click on start button 2. type: gpedit.msc 3. right click on gpedit.msc and run as Administrator

lelouch.lamperouge · Nov 6, 2023

WINDOWS DEFENDER IS NOT REMOVING THREATS

I'm having a problem with Windows Defender the threats found after I ran a full scan that last maybe around 10 hours cannot be removed by windows defender. I selected the remove option and it shows processing but after a while
the threats are still listed and active. I already ran a offline scan and a quick scan but neither fix the problem.

I already ran a secure boot and see if third-party apps are causing the problem but nothing works the threats are still listed and active. I checked the location of the file and manually deleted it even on my recycle bin but
the threats are still there and labeled as active. This very annoying. I think this is an error in the windows defender part because I installed Malwarebytes and ran a full scan which took a couple of hours and found nothing because like I've said I have deleted
the file location where the threats are.

Brink · Nov 6, 2023

Announcing Microsoft Threat Experts

We’re excited to introduce Microsoft Threat Experts, an additional layer of expertise and optics that Microsoft customers can utilize to augment security operations capabilities as part of Microsoft 365. This new managed threat hunting service in Windows Defender Advanced Threat Protection provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately.

Microsoft Threat Experts enables SOCs to jump-start threat investigations by providing context-rich intelligence. This release of the service includes 2 capabilities:

Targeted attack notifications: Alerts that are tailored to organizations provide as much information as can be quickly delivered to bring attention to critical threats in their network, including the timeline, scope of breach, and the methods of intrusion.

Experts on demand: When a threat exceeds the SOC’s capability to investigate, or when more actionable information is needed, security experts provide technical consultation on relevant detections and adversaries. In cases where a full incident response becomes necessary, seamless transition to Microsoft incident response (IR) services is available.

hMYOb81kDYE
Microsoft Threat Experts

With Microsoft Threat Experts, SOCs can further improve defenses by tapping into our world-class security analysts. These experts deeply understand the security landscape and attacker techniques, have intimate knowledge of operating systems, and know how to get the most out of Windows Defender ATP’s features and capabilities. Our experience in battling attackers across more than a billion devices worldwide, together with the artificial intelligence (AI) necessary to harness such unprecedented optics and scale, makes our expert team unique and unmatched in the industry.

The next sections describe the two components of this new service in more detail.

Targeted attack notifications

Microsoft Threat Experts provides proactive hunting for the most important threats, such as human adversary intrusions, hands-on-keyboard attacks, and advanced attacks like cyberespionage. The managed threat hunting service includes:

Threat monitoring and analysis, reducing attacker dwell time and risk to business

Hunter-trained AI to discover and prioritize both known and unknown attacks

Identifying the most important risks, helping SOCs maximize time and energy

Scope of compromise and as much context as can be quickly delivered to enable fast SOC response

Custom Threat Experts alert in Windows Defender Security Center

Experts on demand

Customers can partner with Microsoft security experts, who can be engaged directly from within Windows Defender Security Center, for timely and accurate response. Experts provide insights needed to better understand complex threats, from the latest zero-day exploit to the root cause of a suspicious network connection. Through Microsoft Threat Experts, customers can:

Get additional clarification on alerts including root cause or scope of the incident

Gain clarity into suspicious machine behavior and recommended next steps if faced with an advanced attacker

Determine risk and protection regarding threat actors, campaigns, or emerging attacker techniques

Seamlessly transition to Microsoft Incident Response (IR) services when necessary

Ask a Threat Expert button in Windows Defender Security Center

Partnership for improved security

In today’s climate of cybersecurity challenges, organizations must fend off relentless attacks even as they go through their journey of building and maturing their security capabilities. Through Microsoft Threat Experts, customers can partner with Microsoft throughout this journey to augment security operations capabilities to prevent, detect, and respond to threats. Customers and Microsoft can build upon each other’s expertise, intelligence, and insight through this partnership, forming stronger defense against adversaries.

To illustrate the depth of intelligence and the value of the service to customers’ security defenses and overall security posture, we published two case studies for Microsoft Threat Experts on (1) human adversary-based activities related to a zero-day vulnerability and (2) complex “living off the land” threats.

Windows Defender ATP customers can now apply for preview through the Windows Defender Security Center. We will contact customers via email to confirm their participation.

Not yet reaping the benefits of Windows Defender ATP’s industry-leading optics and detection capabilities? Sign up for free trial today.
Click to expand...

Source: Announcing Microsoft Threat Experts - Microsoft Security

See also: Microsoft Threat Experts: Case studies for managed threat hunting service - Microsoft Tech Community - 358244

Tweet

— Twitter API (@User) View on Twiiter

Windows 10: Microsoft Security/Defender shows a deleted threat

Microsoft Security/Defender shows a deleted threat

Microsoft Security/Defender shows a deleted threat

Microsoft Security/Defender shows a deleted threat

Microsoft Security/Defender shows a deleted threat - Similar Threads - Microsoft Security Defender

Windows defender shows an deleted threat

Windows defender shows an deleted threat

Windows defender shows an deleted threat

Windows Defender shows deleted Threat

Windows Defender shows deleted Threat

Microsoft Security/Defender shows a deleted threat

Threat Blocked on Microsoft Defender

Windows defender shows an deleted threat

Windows Defender not showing threats