Microsoft Defender tamper protection is a Windows security feature that blocks unauthorized changes to important Defender settings. It helps keep protections such as real-time scanning, cloud-delivered protection, and behavior monitoring from being disabled by malware, scripts, or low-privilege users. In practice, it adds a layer of resistance against attempts to weaken endpoint defenses from inside the machine.
In cyber attacks, tamper protection matters because many threats try to turn off antivirus controls before dropping payloads, persisting, or moving laterally. If an attacker can change Defender configuration, detection becomes much easier to evade. Defenders should treat any attempt to alter Defender settings as a high-signal event and verify that tamper protection is enabled and centrally managed. It is not a complete shield, but it raises the cost of post-exploitation abuse and can buy valuable time for response.