Advanced Defender Features

Controlled Folder Access

Controlled Folder Access is a ransomware protection feature that prevents unauthorized applications from making changes to files in protected folders. When enabled, only applications on the allowed list can write to, modify, or delete files in designated directories.

This is one of the most effective defenses against ransomware. Even if malware manages to execute on your system, it cannot encrypt files in protected folders because the operating system blocks the write attempt at the kernel level.

Enabling Controlled Folder Access

Via PowerShell (as Administrator):

# Enable Controlled Folder Access
Set-MpPreference -EnableControlledFolderAccess Enabled

# Check current status
Get-MpPreference | Select-Object EnableControlledFolderAccess

Managing Protected Folders

By default, Controlled Folder Access protects the Documents, Pictures, Videos, Music, Desktop, and Favorites folders. You can add additional folders:

# Add a custom protected folder
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\ImportantData"

# View all protected folders
Get-MpPreference | Select-Object -ExpandProperty ControlledFolderAccessProtectedFolders

Allowing Applications Through

Legitimate applications may be blocked from writing to protected folders. When this happens, you will receive a notification. To allow a specific application:

# Allow an application through Controlled Folder Access
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\MyApp\myapp.exe"

# View allowed applications
Get-MpPreference | Select-Object -ExpandProperty ControlledFolderAccessAllowedApplications

Exploit Protection

Exploit Protection applies mitigation techniques to individual applications and to the operating system as a whole. These mitigations make it significantly harder for attackers to exploit software vulnerabilities, even when patches are not yet available (zero-day attacks).

System-Level Settings

Key system-level mitigations and what they do:

Per-Application Settings

The Program settings tab lets you apply or override mitigations for specific executables. This is useful when a system-level mitigation causes compatibility issues with certain software.

# Export current exploit protection settings to XML
Get-ProcessMitigation -RegistryConfigFilePath settings.xml

# Import exploit protection settings from XML
Set-ProcessMitigation -PolicyFilePath settings.xml

# View mitigations for a specific process
Get-ProcessMitigation -Name "chrome.exe"

Network Protection

Network Protection extends SmartScreen filtering to all outbound HTTP and HTTPS traffic on the system, not just web browsers. It blocks connections to domains known to host phishing scams, malware distribution, exploit kits, and command-and-control servers.

This is particularly valuable because many malware families communicate with remote servers after initial infection. Network Protection can cut off this communication even if the malware itself evades detection.

Enabling Network Protection

Network Protection is not enabled by default on consumer editions of Windows. You must enable it through PowerShell or Group Policy:

# Enable Network Protection (Block mode)
Set-MpPreference -EnableNetworkProtection Enabled

# Enable in Audit mode (logs events without blocking - good for testing)
Set-MpPreference -EnableNetworkProtection AuditMode

# Disable Network Protection
Set-MpPreference -EnableNetworkProtection Disabled

# Check current status
Get-MpPreference | Select-Object EnableNetworkProtection

Attack Surface Reduction Rules

Attack Surface Reduction (ASR) rules target specific behaviors commonly used by malware and exploits. Unlike traditional antivirus which looks for known malicious files, ASR rules block suspicious behaviors regardless of whether the file itself is recognized as malicious.

For example, an ASR rule can block Microsoft Office applications from creating child processes. Legitimate Office usage rarely requires this, but macro-based malware relies on it to execute payloads. The rule stops the behavior without needing to know about the specific malware variant.

Important ASR Rules

Enabling ASR Rules via PowerShell

# Enable a single ASR rule in Block mode
# Example: Block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled

# Enable in Audit mode (recommended first)
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions AuditMode

# Enable multiple rules at once
Set-MpPreference -AttackSurfaceReductionRules_Ids `
    d4f940ab-401b-4efc-aadc-ad5f3c50688a, `
    75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84, `
    d3e037e1-3eb8-44c8-a917-57927947596d `
    -AttackSurfaceReductionRules_Actions Enabled, Enabled, Enabled

# View current ASR rule status
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

SmartScreen Configuration

Microsoft Defender SmartScreen protects against phishing websites, malicious downloads, and potentially unwanted applications. It works by checking URLs and file hashes against Microsoft's cloud-based reputation database.

SmartScreen for Microsoft Edge

SmartScreen for Other Browsers

SmartScreen for Microsoft Edge is built in, but other browsers have their own protective systems. Google Chrome and Brave use Google Safe Browsing, and Firefox uses a combination of Google Safe Browsing and its own threat lists. The "Check apps and files" setting in Windows Security still applies system-wide to downloaded executables regardless of which browser downloaded them.

PowerShell Defender Management

PowerShell provides comprehensive access to every Defender setting. This is essential for automation, scripting consistent configurations across machines, and accessing settings not exposed in the Windows Security graphical interface.

Essential PowerShell Commands

# View complete Defender configuration
Get-MpPreference

# View current threat status and statistics
Get-MpComputerStatus

# View detected threats
Get-MpThreat

# View threat detection history
Get-MpThreatDetection

# Remove an active threat (by ThreatID from Get-MpThreat)
Remove-MpThreat

Configuring Protection Levels

# Set cloud protection level (0=Default, 1=Moderate, 2=High, 4=High+, 6=Zero tolerance)
Set-MpPreference -CloudBlockLevel 2

# Set cloud check timeout (seconds to wait for cloud verdict)
Set-MpPreference -CloudExtendedTimeout 50

# Enable Potentially Unwanted Application protection
Set-MpPreference -PUAProtection Enabled

# Enable behavior monitoring
Set-MpPreference -DisableBehaviorMonitoring $false

# Enable scanning of all downloaded files and attachments
Set-MpPreference -DisableIOAVProtection $false

Creating a Security Audit Script

The following script checks the status of all major Defender features and reports any that are not configured optimally:

# Defender Security Audit Script
$status = Get-MpComputerStatus
$prefs = Get-MpPreference

Write-Host "=== Windows Defender Security Audit ===" -ForegroundColor Cyan
Write-Host ""

# Core protection
$checks = @(
    @{ Name = "Antivirus Enabled"; Value = $status.AntivirusEnabled; Expected = $true },
    @{ Name = "Real-time Protection"; Value = $status.RealTimeProtectionEnabled; Expected = $true },
    @{ Name = "Behavior Monitoring"; Value = -not $prefs.DisableBehaviorMonitoring; Expected = $true },
    @{ Name = "IOAV Protection"; Value = -not $prefs.DisableIOAVProtection; Expected = $true },
    @{ Name = "Network Protection"; Value = ($prefs.EnableNetworkProtection -eq 1); Expected = $true },
    @{ Name = "PUA Protection"; Value = ($prefs.PUAProtection -eq 1); Expected = $true },
    @{ Name = "Controlled Folder Access"; Value = ($prefs.EnableControlledFolderAccess -eq 1); Expected = $true }
)

foreach ($check in $checks) {
    $icon = if ($check.Value -eq $check.Expected) { "[OK]" } else { "[!!]" }
    $color = if ($check.Value -eq $check.Expected) { "Green" } else { "Red" }
    Write-Host "$icon $($check.Name): $($check.Value)" -ForegroundColor $color
}

# Signature age
$sigAge = (Get-Date) - $status.AntivirusSignatureLastUpdated
Write-Host ""
if ($sigAge.TotalHours -gt 48) {
    Write-Host "[!!] Signatures are $([math]::Round($sigAge.TotalHours)) hours old" -ForegroundColor Red
} else {
    Write-Host "[OK] Signatures updated $([math]::Round($sigAge.TotalHours)) hours ago" -ForegroundColor Green
}

Now Do It Yourself: Enable a Rule Without Breaking Someone's Work

Attack Surface Reduction is the most powerful thing on this page and the most commonly abandoned. It is rarely abandoned because it fails to catch attacks — it is abandoned because it caught something legitimate on the first day. In fifteen minutes you can watch that happen, and then watch the mode that prevents it.

You need Python 3. Nothing malicious is created and nothing is executed — the sample files are inert text that is only ever read. Steps 1–4 were run to produce every output below; step 5 is Windows and is marked where it could not be.

mkdir -p sample_files && cd sample_files
printf 'Set objShell = CreateObject("WScript.Shell")\nobjShell.Run "powershell -enc SQBFAFgA"\n' > invoice_macro.doc.vbs
printf 'Sub AutoOpen()\n  CreateObject("WScript.Shell").Run "cmd /c echo hi"\nEnd Sub\n' > quarterly_report.docm
printf 'Set objShell = CreateObject("WScript.Shell")\nobjShell.Run "\\\\fileserver\\deploy\\install.bat"\n' > it_deploy_script.vbs
printf 'Dear team,\nPlease find the quarterly numbers attached.\n' > covering_note.txt
ls -1

covering_note.txt
invoice_macro.doc.vbs
it_deploy_script.vbs
quarterly_report.docm

import sys, pathlib

# One Attack Surface Reduction rule, modelled: "block Office-style files from
# launching a shell". Real ASR rules watch process behaviour; the shape is the same.
RULE = "ASR: file launches a shell process"
TRIGGER = b"CreateObject(\"WScript.Shell\")"

mode = sys.argv[1] if len(sys.argv) > 1 else "audit"
if mode not in ("audit", "block"):
    sys.exit("usage: asr.py [audit|block]")

blocked = flagged = allowed = 0
for path in sorted(pathlib.Path("sample_files").iterdir()):
    hit = TRIGGER in path.read_bytes()
    if hit and mode == "block":
        print(f"  BLOCKED  {path.name:<26} {RULE}")
        blocked += 1
    elif hit:
        print(f"  WOULD BLOCK  {path.name:<22} {RULE}")
        flagged += 1
    else:
        print(f"  allowed  {path.name:<26}")
        allowed += 1

print()
if mode == "block":
    print(f"mode=block  {blocked} file(s) stopped, {allowed} allowed. Users feel this immediately.")
else:
    print(f"mode=audit  {flagged} file(s) WOULD have been stopped, {allowed} allowed. Nothing broke.")

python3 asr.py block

  allowed  covering_note.txt         
  BLOCKED  invoice_macro.doc.vbs      ASR: file launches a shell process
  BLOCKED  it_deploy_script.vbs       ASR: file launches a shell process
  BLOCKED  quarterly_report.docm      ASR: file launches a shell process

mode=block  3 file(s) stopped, 1 allowed. Users feel this immediately.

python3 asr.py audit

  allowed  covering_note.txt         
  WOULD BLOCK  invoice_macro.doc.vbs  ASR: file launches a shell process
  WOULD BLOCK  it_deploy_script.vbs   ASR: file launches a shell process
  WOULD BLOCK  quarterly_report.docm  ASR: file launches a shell process

mode=audit  3 file(s) WOULD have been stopped, 1 allowed. Nothing broke.

Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions AuditMode

Summary

In this tutorial, you learned how to configure advanced Defender features:

• Controlled Folder Access to protect against ransomware encrypting your files
• Exploit Protection mitigations to harden the OS and individual applications
• Network Protection to block malicious domain connections system-wide
• Attack Surface Reduction rules to prevent common malware behaviors
• SmartScreen configuration for reputation-based protection
• PowerShell commands for comprehensive Defender management and auditing