MsMpEng.exe
Sources: 300M+ executions observed in the wild and observed in the EchoTrail lab on Windows 11.
Summary
Microsoft Malware Protection Engine - core antimalware scanning engine for Windows Defender / Microsoft Defender Antivirus.
MsMpEng.exe is the 557th most commonly executed Windows program in EchoTrail's dataset, observed 8,981 times across enterprise environments. It typically runs from C:\ProgramData\... and it is most often launched by services.exe.
Get this in your tools
The same record for msmpeng.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/msmpeng.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\ProgramData\...89.71%
- C:\Program Files\Windows Defender10.09%
- C:\Program Files\Microsoft Security Client0.2%
- C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0
- C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0
Top Hashes (SHA256)
- 641bcd04d2ec651a4612fc37e2487cb93ed1998baaac2a14031515ee292c893e5.32%
- e00c7bf4529b4eb434aa7086cbcabe6ad08ace765e0c6ec8225282378989e2f35.07%
- bcbaa0796c601bdfc4829add08ef34609291bd424eef526a07960dd6b66b94c93.49%
- de0dc4f2e623a2f3ab5f57010765954a77e52d995af74f6d8a52841c941c041b3.23%
- 4fbe52aec27f8e0fb97d6c40c0c90787de53bda499a05cdc1e94be691055c2c63.1%
- 9c47bcedf290cc9915b65fa26c11cf2940bb5addd03dcbdccef91e4a45c2289e2.81%
- 2ff320449da555d46807013f241dcf3d3a68f3ba2b692686479b8b32504f42d82.71%
- cf0902fe24ce006ccaa9675928bea6d0920b11d584012c298ff1e5b6b2ab972a2.58%
- 2ccb6063389f3512be2ef169e236c7474380c542abd82b4b6bcaa8dee2e3dcbe2.28%
- 4c50cb2656c0883129011505b21dfb7bb85cc6652399d3ddeccb66ce9f319af52.27%
- 7272962632224709cebd1e7f4560f99a068e513545b530ad7929a085b6a921aa
- a5eb49c99a7785f6084594cf0609371d6d6d38e370a41b70e36bb3b571117fcd
Code Signing
Signers by share of executions
- 100%Microsoft Windows PublisherValidEmbedded signature · 2 hashes
- Chain
- Microsoft Windows Publisher
- Windows Production PCA 2023
- Microsoft Root Certificate Authority 2010
- Valid
- Apr 30, 2026 to Apr 29, 2027
- Hashes
- a5eb49c99a7785f6084594cf0609371d6d6d38e370a41b70e36bb3b571117fcd55.29% of executions, first seen Sep 10, 2026
- 7272962632224709cebd1e7f4560f99a068e513545b530ad7929a085b6a921aa44.71% of executions, first seen Sep 17, 2026
Full certificate detail on Team.
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe97.29%
- cmd.exe2.71%
Top Children
- MpCmdRun.exe68.73%
- svchost.exe13.75%
- wevtutil.exe11.48%
- DismHost.exe4.35%
- mofcomp.exe0.53%
- taskkill.exe0.52%
- mpengine.exe0.45%
- werfaultsecure.exe0.01%
- wermgr.exe0.01%
Lab record
- Installed from
- winget Microsoft.WindowsSDK.10.0.22621 10.0.22621.2428
- Publisher
- Microsoft Windows Publisher
- Persistence
- none
- Network
- none
- Command lines
- 2 patterns (15 launches)
- DLL loads
- 106 patterns (1,655 loads)
- Registry writes
- 360 patterns (83,490 writes)
- File writes
- 266 patterns (1,116 writes)
- HTTP requests
- 0 patterns (0 requests)
- TLS connections
- 0 patterns (0 handshakes)
- Named pipes
- 0 patterns (0 events)
- Process access
- 63 patterns (1,021 events)
- Driver loads
- 12 patterns (12 loads)
- PowerShell blocks
- 0 patterns (0 blocks)
- Remote threads
- 0 patterns (0 events)
- Audit events
- 0 patterns (0 events)
Full record on Team.
Security Analysis
What does MsMpEng.exe normally do?
Runs as the core scanning process for Windows Defender. High CPU during active scans is expected. Runs as SYSTEM from %ProgramFiles%\Windows Defender\MsMpEng.exe.
When is MsMpEng.exe suspicious?
Not running when Defender should be active. Running from a path other than the Windows Defender directory. Crashing repeatedly.
How do attackers abuse MsMpEng.exe?
Attackers attempt to disable or tamper with MsMpEng.exe. Some exploits have targeted the Defender engine itself (CVE-2017-0290 allowed remote code execution via crafted files scanned by the engine).
Detection guidance
Monitor for Defender service stops (Event ID 5001). Alert on Defender exclusion additions (Event ID 5007). Detect attempts to tamper with Defender via PowerShell Set-MpPreference.
False positive notes
High CPU during scheduled scans is normal. Temporary service restarts during definition updates are expected.
Related Processes
Ask Rocky about MsMpEng.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for MsMpEng.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.