My advice for solving the issues (3002/Disabled WD) with the faulty Defender signatures updates
“cd %ProgramFiles%\Microsoft Security Client”
“MpCmdRun.exe -removedefinitions -dynamicsignatures”
“MpCmdRun.exe -SignatureUpdate -MMPC”
And reboot!
To fix the issues with RP and BM after 1477 and 1481:
cd %ProgramFiles%\Microsoft Security Client
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate -MMPC
To investigate locally whether BehaviorMonitoring is active:
cc: @BleepinComputer
3/3
Clearing the old signatures and install the latest signature did solve the issue, behaviormonitoring went from disabled(false) to enabled(true).
cd %ProgramFiles%\Microsoft Security Client
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate -MMPC
Command used to remove Windows Defender definitions? "C:\Windows\System32\cmd.exe" /c cd "C:\Program Files\Windows Defender" & MpCmdRun.exe -removedefinitions -dynamicsignatures #Cybersecurity#Infosec#Threatintel