Skip to main content
Version: 2.1.1-preview

MT.1160 - Signatures should be checked before scan

Overview​

Checks that signature checking before scan is enabled for zero-day protection in all assigned Microsoft Defender Antivirus policies.

Scans with outdated signatures may miss recent threats and zero-day attacks, leaving endpoints exposed to newly discovered vulnerabilities.

Remediation action:​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Enable Check for Signatures Before Running Scan

Test Metadata​

FieldValue
Test IDMT.1160
SeverityHigh
SuiteM365 Advisor
CategoryDefender
PowerShell testTest-MtMdeSignatureBeforeScan
TagsDefender, M365Advisor, MT.1160

Remediation​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Enable Check for Signatures Before Running Scan

Source​

  • Pester test: tests/M365Advisor/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
  • PowerShell source: powershell/public/M365Advisor/defender/Test-MtMdeSignatureBeforeScan.ps1