This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch. Office apps, such as Word or Excel, will not be allowed to create child processes. Windows Defender AV must be configured block Office applications from creating child processes.

If definitions are determined to be out of date this state may. This policy setting allows you to define the number of days that must pass before virus definitions are considered out of date. Windows Defender AV virus definition age must not exceed 7 days. This policy setting allows you to define the number of days that must pass before spyware definitions are considered out of date. Windows Defender AV spyware definition age must not exceed 7 days. If you enable this policy setting Windows Defender does not run and computers are not scanned for malware or other potentially unwanted software. This policy setting turns off Windows Defender. Windows Defender AV must be configured to run and scan for malware and other potentially unwanted software. Windows Defender AV must be configured to enable the Potentially Unwanted Application (PUA) feature.Īfter enabling this feature, Potentially Unwanted Application (PUA) protection blocking takes effect on endpoint clients after the next signature update or computer restart. Findings (MAC III - Administrative Sensitive) Finding ID

Microsoft defender antimalware