You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/hardware-acceleration-and-mdav.md
+10-7Lines changed: 10 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,13 +7,16 @@ manager: deniseb
7
7
ms.reviewer: yongrhee
8
8
ms.service: defender-endpoint
9
9
ms.topic: overview
10
-
ms.date: 09/18/2024
10
+
ms.date: 12/05/2024
11
11
ms.subservice: ngp
12
+
ms.collection:
13
+
- m365-security
14
+
- tier2
15
+
audience: ITPro
12
16
ms.localizationpriority: medium
13
17
ms.custom: partner-contribution
14
18
search.appverid: MET150
15
19
f1 keywords: NOCSH
16
-
audience: ITPro
17
20
---
18
21
19
22
# Hardware acceleration and Microsoft Defender Antivirus
@@ -40,16 +43,16 @@ This table shows the Intel TDT technologies Microsoft collaborated with Intel on
40
43
41
44
|Available since |Intel TDT technology | Intel Threat Detection Technology (TDT) available on|
42
45
|:---|:---|:---|
43
-
|2018|Intel TDT – Accelerated Memory Scanning (AMS)|Intel integrated graphic 6th Gen Core (circa 2015) or newer family of processors, running on laptops, tablets, and desktop systems.|
44
-
|2021|Intel TDT - Cryptojacking detector| Intel 6th Gen Core (circa 2015) or newer family of processors, running on laptops, tablets, and desktop systems.|
45
-
|2022|Intel TDT - Ransomware detector| Intel 8th Gen Core or newer family of processors.|
46
+
|2018|Intel TDT – Accelerated Memory Scanning (AMS)|Intel integrated graphic sixth Gen Core (circa 2015) or newer family of processors, running on laptops, tablets, and desktop systems.|
47
+
|2021|Intel TDT - Cryptojacking detector| Intel sixth Gen Core (circa 2015) or newer family of processors, running on laptops, tablets, and desktop systems.|
48
+
|2022|Intel TDT - Ransomware detector| Intel eighth Gen Core or newer family of processors.|
46
49
47
50
**Intel Threat Detection Technology (TDT) - Accelerated Memory Scanning (AMS):** Introduced extra memory scanning capabilities to detect fileless attacks that are expensive on the Central Processing Unit (CPU), and then offload them to the integrated Graphics Processor Unit (integrated GPU). Two benefits are:
48
51
49
52
- lower CPU consumption
50
53
- A reduction of System-on-a-chip (SoC) power consumption leading to longer battery life on laptops and tablets
51
54
52
-
**Intel Threat Detection Technology (TDT) - Cryptojacking:** Enhanced detection by leveraging Intel's Central Processing Unit (CPU) performance monitoring unit (PMU) and offloading to the integrated Graphics Processor Unit (integrated GPU) to detect the malware code execution (fingerprint) of repeated mathematical operations at runtime. The signals are processed by a layer of machine learning with minimal overhead.
55
+
**Intel Threat Detection Technology (TDT) - Cryptojacking:** Enhanced detection by using Intel's Central Processing Unit (CPU) performance monitoring unit (PMU) and offloading to the integrated Graphics Processor Unit (integrated GPU) to detect the malware code execution (fingerprint) of repeated mathematical operations at runtime. Machine learning processes signals with minimal overhead.
53
56
54
57
### How do you enable Intel TDT AMS or Cryptojacking integration?
55
58
@@ -61,7 +64,7 @@ The regular Microsoft Defender Antivirus Event ID **1116**.
61
64
62
65
### What type of attacks does it help with?
63
66
64
-
- We use the Intel TDT - Cryptojacking detector to thwart various cryptojacking mallards. The following Coinminer campaigns were successfully detected and blocked using the TDT Cryptojacking detector: [YouTube Pirated Software Videos Deliver Triple Threat: Vidar Stealer, LaPlasa Clipper, XMRig Miner](https://www.fortinet.com/blog/threat-research/youtube-pirated-software-videos-deliver-triple-threat-vidar-stealer-laplas-clipper-xmrig-miner)
67
+
- We use the Intel TDT - Cryptojacking detector to thwart various cryptojacking malware. The following Coinminer campaigns were successfully detected and blocked using the TDT Cryptojacking detector: [YouTube Pirated Software Videos Deliver Triple Threat: Vidar Stealer, LaPlasa Clipper, XMRig Miner](https://www.fortinet.com/blog/threat-research/youtube-pirated-software-videos-deliver-triple-threat-vidar-stealer-laplas-clipper-xmrig-miner)
65
68
66
69
- We use the Intel TDT detector to identify instances of CryptoJacking malware abusing Windows binaries (lolbins), and then employ Defender behavior monitoring to prevent and block such activities effectively. For more information, see [Hardware-based threat defense against increasingly complex cryptojackers](https://www.microsoft.com/security/blog/2022/08/18/hardware-based-threat-defense-against-increasingly-complex-cryptojackers/).
0 commit comments