Deploying Defender offline scan after malware detection

Overview

Microsoft Defender Offline (boot-level scan) helps remove persistent threats that resist normal cleaning. Use when layered detections suggest rootkit behavior or repeated reinfection.

When to choose offline scan vs reimage

• Offline scan when time pressure is high, data must stay on disk, and IR approves.
• Reimage when firmware/rootkit suspicion is high or regulatory policy mandates.

Procedure (Windows client)

1. Ensure BitLocker recovery keys are escrowed and accessible.
2. Schedule scan during maintenance window; warn user about long downtime.
3. Launch Windows Security > Virus & threat protection > scan options > Microsoft Defender Offline scan—or deploy via scripted method per platform.
4. After reboot and scan, review quarantine and threat history; run full scan again in Windows.

Follow-up

• Patch exploited vulnerabilities.
• Reset passwords for accounts that used the device.
• Hunt for similar IOCs across tenant.

Documentation

Attach scan completion logs, threats removed, and any exclusions requested (with approvals).

Client communication template

“We ran a deep boot-level scan to remove malware that can hide from standard antivirus. The device is clean per current telemetry; we recommend password resets and will monitor for 48 hours.”