PowerShell: Check Current Windows Defender Threats
Need to check for currently active or recently detected threats - separate from the full historical log? This one-liner pulls it straight from the system.
Prerequisites:
- Privileges: None
- Module: Built-in, no import needed
Quick Command:
Get-MpThreatExample Output:
(no output)An empty result here simply means no active or recent threats are currently present - it's not an indication the command failed.
📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- Get-MpThreat returns currently active or recently detected threats - a narrower, more focused view than Get-MpThreatDetection, which returns the complete historical log including already-resolved detections.
- When present, entries would include the threat name, severity level, and current status (e.g. quarantined, active).
- A clean, empty result means Defender currently has nothing flagged as an active concern on the system.