Skip to main content
Version: 2.1.1-preview

MT.1160 - Signatures should be checked before scan

Boris Drogja
Contributed by Boris DrogjaAll contributors →

Overview​

Checks that signature checking before scan is enabled for zero-day protection in all assigned Microsoft Defender Antivirus policies.

Scans with outdated signatures may miss recent threats and zero-day attacks, leaving endpoints exposed to newly discovered vulnerabilities.

Remediation action:​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Enable Check for Signatures Before Running Scan

Test Metadata​

FieldValue
Test IDMT.1160
SeverityHigh
SuiteMaester
CategoryDefender
PowerShell testTest-MtMdeSignatureBeforeScan
TagsDefender, Maester, MT.1160

Source​

  • Pester test: tests/Maester/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
  • PowerShell source: powershell/public/maester/defender/Test-MtMdeSignatureBeforeScan.ps1