Blog Post

Microsoft Defender for Endpoint Blog
2 MIN READ

Block malicious command lines with Microsoft Defender for Endpoint

SaadK's avatar
SaadK
Icon for Microsoft rankMicrosoft
Feb 05, 2025
The modern threat landscape is rapidly evolving, with new attack strategies being employed at greater frequency and volume than we have seen in the past. One such tactic we have recently observed acr...
A diagram that shows how command lines are scanned and blocked by Microsoft Defender for Endpoint.
Updated Feb 20, 2025
Version 2.0
3ndp01nt's avatar
3ndp01nt
Copper Contributor
Feb 05, 2025

Does the “Block malicious command line” capability work if you run MDE in Passive mode with a third party AV running? In EDR mode essentially. 

KittyOverlord's avatar
KittyOverlord
Copper Contributor
Feb 06, 2025

"Passive mode - In passive mode, Microsoft Defender Antivirus isn't used as the primary antivirus app on the device. Files are scanned, and detected threats are reported, but threats aren't remediated by Microsoft Defender Antivirus."