Microsoft Defender for Endpoint
Endpoint protectionBehavior monitoring in Microsoft Defender Antivirus
In brief
The article now explains real-time detection, dynamic analysis, response and remediation, and identifies Antimalware and Network protection features that depend on behavior monitoring. It also updates configuration-tool guidance and adds verification and performance-troubleshooting context.
What Defender admins need to know
Administrators can use the revised guidance to understand dependencies, manage behavior monitoring, and troubleshoot performance while keeping the default, tamper-protected setting enabled.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Behavior monitoring in Microsoft Defender Antivirus
Behavior monitoring is a critical Microsoft Defender Antivirus detection and protection functionality of Microsoft Defender Antivirus.
Monitors process behavior to detectcapability. It observes process, file, and analyze potentialservice activity in real time and detects threats based on the behavior of applications, services, and files. Rather than relying solely on signature-based detection (which identifiesfrom suspicious behavior, including threats that don't match known malware patterns),signatures.
How behavior monitoring focuses on observing how software behaves in real-time. Here's what it entails:- works
Real-Time Threat Detection:Behavior monitoring uses these approaches to identify and stop suspicious activity:
- Real-time threat detection: Continuously
observeobserves processes, file systemactivities,activity, and interactionswithinon thesystem. - device. For example, Microsoft Defender Antivirus can
identifydetect unusual file changes or attempts to create or modify autostart extensibility point (ASEP) registry keys. - Dynamic analysis: Uses known behavior patterns
associated with malware or other threats. For example, it looks for processes making unusual changesand anomaly detection toexisting files, modifying or creating automatic startup registry (ASEP) keys, and other alterations to the file system or structure.
Dynamic Approach:
Unlike static, signature-based detection, behavior monitoring adapts toidentify new and evolvingthreats.threats while software runs.Microsoft Defender Antivirus uses predefined patterns,Response andobserves how software behaves during execution. For malware that doesn't fit any predefined pattern, Microsoft Defender Antivirus uses anomaly detection.Ifremediation: Takes action when a programshows suspicious behavior (for example,behaves suspiciously, such as attempting to modify critical systemfiles), Microsoft Defender Antivirus can take action to prevent further harm, and revert some previous malware actions.files.
Behavior monitoring enhances Defender Antivirus's ability to proactively detect emerging threats by focusing on real-time actions and behaviors rather than relying solely on known signatures.
Theis required for the following features depend on behavior monitoring.
Anti-malware:features:
Indicators,Antimalware: Filehash, allow/hash allow and block indicators.
Indicators,IPaddress/URL, allow/address and URL allow and blockWeb Content Filtering, allow/blockindicators, and web content filtering.
Change the behavior monitoring policy
Use one of the following management tools to configure behavior monitoring.
| Management tool | Setting | Documentation |
|---|---|---|
| Defender for Endpoint security settings management | Allow behavior monitoring | Manage Microsoft Defender Antivirus through security settings management |
| Allow behavior monitoring | Microsoft Defender Antivirus policy settings for Windows | |
| Configuration service provider (CSP) | AllowBehaviorMonitoring | |
| Configuration Manager |
Turn on behavior monitoring | |
| Group Policy | Turn on behavior monitoring | |
| PowerShell | Set-MpPreference |
Set-MpPreference |
| MSFT_MpPreference class |
If you use Microsoft Defender for Business, see Review or edit your next-generation protection policies in Microsoft Defender for Business.
Modify the behavior monitoring settings by using PowerShell
UseTo enable behavior monitoring, run the following command to modify the behavior monitoring settings:in an elevated PowerShell session (a PowerShell window you opened by selecting Run as administrator):
Set-MpPreference -DisableBehaviorMonitoring <true | false>$false
To temporarily disable behavior monitoring for troubleshooting, run the following command in an elevated PowerShell session:
TrueSet-MpPreference -DisableBehaviorMonitoring $truedisables Behavior monitoring.Falseenables Behavior monitoring.
Changes made with PowerShell affect the local device. Policies deployed through Defender for Endpoint security settings management, Microsoft Intune, Configuration Manager tenant attach, or Group Policy can overwrite local changes.
For more information, see Set-MpPreference.
Query the behavior monitoring status from PowerShell
Run the following command to display the current behavior monitoring status:
Get-MpComputerStatus | Format-Table BehaviorMonitorEnabled
If the value returned iscommand returns trueTrue
Query the behavior monitoring status by using Advanced Hunting
You can use Advanced Hunting (AH) to query the status of behavior monitoring.
Requires Microsoft Defender,Organizations with Microsoft Defender for Endpoint Plan 2,2 or Microsoft Defender for Business.Business can use advanced hunting to query behavior monitoring status. The query uses the DeviceTvmSecureConfigurationAssessment table in Defender advanced hunting. This method doesn't apply to Defender for Endpoint Plan 1 or Microsoft Defender for Individuals.
let EvalTable = DeviceTvmSecureConfigurationAssessment
## Troubleshooting high CPU usage
Detections related to behaviorBehavior monitoring start with "[Behavior]detections use the [`Behavior` malware naming type](/unified-secops-platform/malware-naming#type)".
When investigatingUse the [Microsoft Defender Antivirus Performance Analyzer](tune-performance-defender-antivirus.md) to identify files, file extensions, and processes that contribute to high CPU usage in `MsMpEng.exe`. Start a recording with **New-MpPerformanceRecording**, you canreproduce the issue, and analyze the recording with **Get-MpPerformanceReport**.
If the results indicate that behavior monitoring might contribute to the issue, use a controlled test to confirm the cause:
1. For eligible enterprise devices, [enable troubleshooting mode](enable-troubleshooting-mode.md) to temporarily change tamper-protected settings.
1. Temporarily turn off tamper protection, and then disable behavior monitoring.
1. Reproduce the performance issue for the shortest practical period.
1. Re-enable behavior monitoring and tamper protection immediately after the test.
Troubleshooting mode is a Defender for Endpoint enterprise feature and doesn't apply to see ifMicrosoft Defender for Individuals.
If disabling behavior monitoring resolves the issues continue.
You canissue, use the Performance analyzer forAnalyzer results to isolate the affected path, file, or process. If the issue started after a Microsoft Defender Antivirus update, follow the documented procedures to find **\path\process**, **process** and/[roll back platform, engine, or **file extensions** that are contributing to the high cpu utilization. You can then add these items to [Contextual Exclusion]security intelligence updates](microsoft-defender-antivirus-exclusions-overview.md#contextual-exclusions)updates.md#how-to-roll-back-an-update). For more information, see [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md).
If you're seeing high CPU usage caused by behavior monitoring, continue troubleshootingRoll back only the issue by reverting eachcomponent suspected of causing the following items in order. Re-issue, and re-enable behavior monitoring after reverting each item to identify wheretest.
If you can're still encountering high t isolate the cause, use the Microsoft Defender for Endpoint Client Analyzer with the MDEClientAnalyzer.cmd -a option to collect Defender Antivirus high-CPU usage issues,tracing data, and then contact Microsoft support and have your Client Analyzer data ready.
If behavior monitoring isn't causing the issue, use [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md) to collect log information. Collect two different logs using `a -c` and `a -a`. Have this information ready when you contact Microsoft support.
For more information, see [Data collection for advanced troubleshooting on Windows](data-collection-analyzer.md).
Support.
@@ -1,100 +1,91 @@ --- title: Behavior monitoring in Microsoft Defender Antivirus-description: Learn about Behavior monitoring in Microsoft Defender Antivirus and Defender for Endpoint.+description: Learn how Microsoft Defender Antivirus behavior monitoring detects threats, how to configure and verify it, and how to troubleshoot performance. author: chrisda ms.author: chrisda ms.reviewer: yongrhee-ms.topic: article+ms.topic: overview ms.service: defender-endpoint ms.subservice: ngp ms.localizationpriority: medium-ms.date: 04/29/2025+ms.date: 08/13/2026 appliesto: - Microsoft Defender for Endpoint Plan 1 - Microsoft Defender for Endpoint Plan 2 - Microsoft Defender for Business - Microsoft Defender for Individuals-+ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1015+#customer intent: As an administrator, I want to understand and manage behavior monitoring so that Microsoft Defender Antivirus can detect suspicious activity while maintaining device performance. ----# Behavior monitoring in Microsoft Defender Antivirus---Behavior monitoring is a critical detection and protection functionality of Microsoft Defender Antivirus.--Monitors process behavior to detect and analyze potential threats based on the behavior of applications, services, and files. Rather than relying solely on signature-based detection (which identifies known malware patterns), behavior monitoring focuses on observing how software behaves in real-time. Here's what it entails:--1. Real-Time Threat Detection:- - Continuously observe processes, file system activities, and interactions within the system.- - Defender Antivirus can identify patterns associated with malware or other threats. For example, it looks for processes making unusual changes to existing files, modifying or creating automatic startup registry (ASEP) keys, and other alterations to the file system or structure.--1. Dynamic Approach:--- Unlike static, signature-based detection, behavior monitoring adapts to new and evolving threats.--- Microsoft Defender Antivirus uses predefined patterns, and observes how software behaves during execution. For malware that doesn't fit any predefined pattern, Microsoft Defender Antivirus uses anomaly detection.--- If a program shows suspicious behavior (for example, attempting to modify critical system files), Microsoft Defender Antivirus can take action to prevent further harm, and revert some previous malware actions. -Behavior monitoring enhances Defender Antivirus's ability to proactively detect emerging threats by focusing on real-time actions and behaviors rather than relying solely on known signatures.+# Behavior monitoring in Microsoft Defender Antivirus -The following features depend on behavior monitoring.+Behavior monitoring is a critical Microsoft Defender Antivirus detection and protection capability. It observes process, file, and service activity in real time and detects threats from suspicious behavior, including threats that don't match known malware signatures. -**Anti-malware**:+## How behavior monitoring works -- Indicators, File hash, allow/block+Behavior monitoring uses these approaches to identify and stop suspicious activity: -**Network Protection**:+- **Real-time threat detection**: Continuously observes processes, file system activity, and interactions on the device. For example, Microsoft Defender Antivirus can detect unusual file changes or attempts to create or modify autostart extensibility point (ASEP) registry keys.+- **Dynamic analysis**: Uses known behavior patterns and anomaly detection to identify new and evolving threats while software runs.+- **Response and remediation**: Takes action when a program behaves suspiciously, such as attempting to modify critical system files. -- Indicators, IP address/URL, allow/block-- Web Content Filtering, allow/block+Behavior monitoring is required for the following features: -> [!NOTE]-> Behavior monitoring is protected by tamper protection.+- **Antimalware**: File hash allow and block indicators.+- **Network protection**: IP address and URL allow and block indicators, and web content filtering. -To temporarily disable behavior monitoring in order to remove it out of the picture, you want to first enable Troubleshooting mode, disable Tamper Protection, and then disable behavior monitoring.+> [!IMPORTANT]+> Behavior monitoring is enabled by default and is protected by tamper protection. Keep behavior monitoring enabled except during a controlled, temporary troubleshooting test. ## Change the behavior monitoring policy -The following table shows the different ways to configure behavior monitoring.+Use one of the following management tools to configure behavior monitoring. -| Management tool | Name | Links |+|Management tool|Setting|Documentation| |---|---|---|-| Security Settings Management | Allow behavior monitoring | This article |-| Intune | Allow behavior monitoring | [Windows Antivirus policy settings for Microsoft Defender Antivirus for Intune](/intune/intune-service/protect/antivirus-microsoft-defender-settings-windows#real-time-protection) |-| CSP | AllowBehaviorMonitoring | [Defender Policy CSP](/intune/intune-service/protect/antivirus-microsoft-defender-settings-windows#real-time-protection) |-| Configuration Manager Tenant Attach | Turn on behavior monitoring | [Windows Antivirus policy settings from Microsoft Defender Antivirus for tenant attached devices](/intune/intune-service/protect/antivirus-microsoft-defender-settings-windows-tenant-attach#real-time-protection) |-| Group Policy | Turn on behavior monitoring | [Download Group Policy Settings Reference Spreadsheet for Windows 11 2023 Update (23H2)](https://www.microsoft.com/download/details.aspx?id=105668) |-| PowerShell | Set-MpPreference -DisableBehaviorMonitoring | [Set-MpPreference](/powershell/module/defender/set-mppreference#-disablebehaviormonitoring) |-| WMI | boolean DisableBehaviorMonitoring; | [MSFT\_MpPreference class](/previous-versions/windows/desktop/defender/msft-mppreference) |+|Defender for Endpoint security settings management|Allow behavior monitoring|[Manage Microsoft Defender Antivirus through security settings management](/intune/intune-service/protect/mde-security-integration)|+|Microsoft Intune|Allow behavior monitoring|[Microsoft Defender Antivirus policy settings for Windows](/intune/device-configuration/endpoint-security/ref-antivirus-defender-settings-windows#real-time-protection)|+|Configuration service provider (CSP)|AllowBehaviorMonitoring|[Defender Policy CSP](/windows/client-management/mdm/policy-csp-defender#allowbehaviormonitoring)|+|Configuration Manager tenant attach|Turn on behavior monitoring|[Microsoft Defender Antivirus policy settings for tenant-attached devices](/intune/device-configuration/endpoint-security/ref-antivirus-defender-settings-windows-tenant-attach#real-time-protection)|+|Group Policy|Turn on behavior monitoring|[Configure Microsoft Defender Antivirus with Group Policy](use-group-policy-microsoft-defender-antivirus.md)|+|PowerShell|**Set-MpPreference** _DisableBehaviorMonitoring_|[Set-MpPreference](/powershell/module/defender/set-mppreference#-disablebehaviormonitoring)|+|Windows Management Instrumentation (WMI)|DisableBehaviorMonitoring|[MSFT\_MpPreference class](/previous-versions/windows/desktop/defender/msft-mppreference)| If you use Microsoft Defender for Business, see [Review or edit your next-generation protection policies in Microsoft Defender for Business](/defender-business/mdb-next-generation-protection). ## Modify the behavior monitoring settings by using PowerShell -Use the following command to modify the behavior monitoring settings:+To enable behavior monitoring, run the following command in an elevated PowerShell session (a PowerShell window you opened by selecting **Run as administrator**):++```powershell+Set-MpPreference -DisableBehaviorMonitoring $false+```++To temporarily disable behavior monitoring for troubleshooting, run the following command in an elevated PowerShell session: ```powershell-Set-MpPreference -DisableBehaviorMonitoring <true | false>+Set-MpPreference -DisableBehaviorMonitoring $true ``` -- `True` disables Behavior monitoring.-- `False` enables Behavior monitoring.+Changes made with PowerShell affect the local device. Policies deployed through Defender for Endpoint security settings management, Microsoft Intune, Configuration Manager tenant attach, or Group Policy can overwrite local changes. For more information, see [Set-MpPreference](/powershell/module/defender/set-mppreference#-disablebehaviormonitoring). ## Query the behavior monitoring status from PowerShell +Run the following command to display the current behavior monitoring status:+ ```powershell Get-MpComputerStatus | Format-Table BehaviorMonitorEnabled ``` -If the value returned is `true`, behavior monitoring is enabled.+If the command returns `True`, behavior monitoring is enabled. ## Query the behavior monitoring status by using Advanced Hunting -You can use Advanced Hunting (AH) to query the status of behavior monitoring.--Requires Microsoft Defender, Microsoft Defender for Endpoint Plan 2, or Microsoft Defender for Business.+Organizations with Microsoft Defender for Endpoint Plan 2 or Microsoft Defender for Business can use advanced hunting to query behavior monitoring status. The query uses the `DeviceTvmSecureConfigurationAssessment` table in Defender advanced hunting. This method doesn't apply to Defender for Endpoint Plan 1 or Microsoft Defender for Individuals. ```kusto let EvalTable = DeviceTvmSecureConfigurationAssessment@@ -128,23 +119,22 @@ withNames | join kind = fullouter DefUpdate on DeviceId ## Troubleshooting high CPU usage -Detections related to behavior monitoring start with "[Behavior](/unified-secops-platform/malware-naming#type)".--When investigating high CPU usage in `MsMpEng.exe`, you can temporarily disable behavior monitoring to see if the issues continue.--You can use Performance analyzer for Microsoft Defender Antivirus to find **\path\process**, **process** and/or **file extensions** that are contributing to the high cpu utilization. You can then add these items to [Contextual Exclusion](microsoft-defender-antivirus-exclusions-overview.md#contextual-exclusions).+Behavior monitoring detections use the [`Behavior` malware naming type](/unified-secops-platform/malware-naming#type). -For more information, see [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md).+Use the [Microsoft Defender Antivirus Performance Analyzer](tune-performance-defender-antivirus.md) to identify files, file extensions, and processes that contribute to high CPU usage in `MsMpEng.exe`. Start a recording with **New-MpPerformanceRecording**, reproduce the issue, and analyze the recording with **Get-MpPerformanceReport**. -If you're seeing high CPU usage caused by behavior monitoring, continue troubleshooting the issue by reverting each of the following items in order. Re-enable behavior monitoring after reverting each item to identify where the problem might be.+If the results indicate that behavior monitoring might contribute to the issue, use a controlled test to confirm the cause: -1. **platform update**-2. **engine update**-3. **security intelligence update**.+1. For eligible enterprise devices, [enable troubleshooting mode](enable-troubleshooting-mode.md) to temporarily change tamper-protected settings.+1. Temporarily turn off tamper protection, and then disable behavior monitoring.+1. Reproduce the performance issue for the shortest practical period.+1. Re-enable behavior monitoring and tamper protection immediately after the test. -If you're still encountering high CPU usage issues, contact Microsoft support and have your Client Analyzer data ready.+Troubleshooting mode is a Defender for Endpoint enterprise feature and doesn't apply to Microsoft Defender for Individuals. -If behavior monitoring isn't causing the issue, use [Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md) to collect log information. Collect two different logs using `a -c` and `a -a`. Have this information ready when you contact Microsoft support.+If disabling behavior monitoring resolves the issue, use the Performance Analyzer results to isolate the affected path, file, or process. If the issue started after a Microsoft Defender Antivirus update, follow the documented procedures to [roll back platform, engine, or security intelligence updates](microsoft-defender-antivirus-updates.md#how-to-roll-back-an-update). Roll back only the component suspected of causing the issue, and re-enable behavior monitoring after each test. -For more information, see [Data collection for advanced troubleshooting on Windows](data-collection-analyzer.md).+> [!WARNING]+> Antivirus exclusions reduce protection. Add a [contextual file or folder exclusion](microsoft-defender-antivirus-exclusions-overview.md#contextual-exclusions) only after you validate that the excluded activity is trusted and that a narrower exclusion can't resolve the issue. +If you can't isolate the cause, use the [Microsoft Defender for Endpoint Client Analyzer](data-collection-analyzer.md) with the `MDEClientAnalyzer.cmd -a` option to collect Defender Antivirus high-CPU tracing data, and then contact Microsoft Support.