MediumOS hardeningBLWK-WIN-002

Microsoft Defender signatures are out of date

What this means

Defender's malware signatures are ‹defender signature age› days old, so recently discovered threats aren't recognised.

How to fix it

Run Update-MpSignature in PowerShell (or Windows Security → Virus & threat protection → Protection updates), and check that Windows Update can reach the internet.

Check it yourself

Run a scan and look for BLWK-WIN-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads windows_security and reports this check when:

defender_signature_age_known == true and defender_signature_age > 7

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1562.001

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001