> Is Windows Defender really effective in 2024? Yes. > You would think any virus designer would design their stuff in a way that the default antivirus built i

> Is Windows Defender really effective in 2024? Yes. > You would think any virus designer would design their stuff in a way that the default antivirus built into the product they are attacking wouldn't be able to find it... You would think that Microsoft would build mechanisms to prevent this. And they do. Avoiding detection is a key goal, to be fair. > And before you say "well duh, but signature updates", I will respond with the fact that nearly malware is designed to auto-update... That's actually very noisy, and an important part of modern malware is avoiding detection - internal and external. Auto-updaters are pretty easy to detect. Even large ISPs will look for auto-update traffic and alert their customers (or in some cases, disable their accounts temporarily!). And once detected, these companies are very well practiced in taking down the hosts of the updates. So that is a "fact" but it's not so black and white :) > And will obviously make sure that the windows defender signatures fail to auto-update... Sounds easy in theory, very hard in practice. On modern systems, requires kernel mode/system/specific elevated privileges. Using a kernel exploit is rare because they're hard to come by and very valuable - limits scope of who an attacker will bother wasting one on. UAC will complain that an unsigned binary is trying to elevate, and such functionality may even be disabled. In fleet machines, the user often cannot escalate their privileges in such a way that allows defender to be disabled. Anti-virus is still relevant and useful, although slowly fading into irrelevance - although there will always be a need by vendors to remove malicious software.