Microsoft Defender for Endpoint Updates & Release Notes

Memory Scan extends Microsoft Defender for Endpoint protection capabilities on Linux by enabling inspection of process memory for known malicious behaviours and memory-resident threats, providing an additional layer of protection against advanced attacks.

Memory-resident threats are increasingly challenging for security teams because they can execute directly in memory with little or no footprint on disk, making them more difficult to detect using traditional file-based scanning techniques.

Memory Scan helps improve visibility into these threats and strengthens protection against sophisticated attack methods such as in-memory malware and malicious code injection.

Available in Defender version 101.26071.0005 or later in Insiders-slow channel.

You can now monitor vulnerabilities on devices running Microsoft Store applications, including Microsoft Teams, Mozilla Firefox, WhatsApp, Slack, Dropbox, DuckDuckGo, Dell Command, HP Smart, HP Support Assistant, Dell SupportAssist for Home PCs, and NVIDIA Control Panel (see Microsoft Store applications for the full list).

Use the Software evidence area in the software page to view the file path for the vulnerable application, along with a suggested query showing the vulnerable app, version, and file location.

Available from Defender for Endpoint on Linux version 101.26042.0011 and later.

The Defender Deployment Tool for Linux simplifies deployment by combining installation, onboarding, upgrades, and uninstallation into a single workflow.

The tool automates prerequisite validation, supports custom installation paths, enables deployment of specific Defender versions from preferred update channels, and works seamlessly in environments that use local repositories.

In addition to a simplified deployment experience, customers can now gain complete visibility into deployment progress through Device Timeline integration, providing step-by-step installation, upgrade, and onboarding status, Advanced Hunting queries for fleet-wide deployment monitoring, and detailed error reporting, including deployment stage, status, exit code, and failure reason to simplify troubleshooting.

These capabilities help administrators quickly identify deployment issues, track onboarding progress, and understand deployment outcomes across their Linux estate.

Available from Defender version 101.26042.0011 onwards.

AI agent runtime protection includes these enhancements:

• Vendor-supported agent event interfaces now work with standard platform and engine update channels, so no Beta channel configuration is required. Agent-native event inspection now supports Codex CLI and the GitHub Copilot app.
• Network inspection is now supported for agents that don't expose vendor-supported event interfaces, including OpenClaw and similar Node.js-based Claw agents. For more information, see AI agent runtime protection with Microsoft Defender for Endpoint.

The new version of the tool streamlines onboarding and enhances security by:

• Bundling the onboarding package directly into the tool's executable.
• Generating a key during deployment package creation that is required for running the tool.
• Enabling users to configure an expiry date for the package to reduce the risk of unauthorized use.

In addition:

• You have the option of downloading the package as either an .exe or a .zip file, whichever best suits your organization's needs.
• A new Deployment packages page in the Defender portal facilitates management of downloaded packages by providing centralized visibility into all the packages and their current status.