Act
active
Microsoft: Ignore False 'Antivirus Turned Off' Alerts After Defender Update
- Engineer — Learn: Defender Antivirus false-positive after recent update may trigger compliance alerts or monitoring noise; no patch or configuration change needed, just awareness that the UI error is benign until Microsoft releases a fix.
- SOC/IR — Act: Suppress or contextually tune alerts for Defender ‘antivirus turned off’ events caused by this update so analysts aren’t flooded with false positives; document the known-issue window to avoid masking real AV-disabling activity.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.