msmpeng.exe

MsMpEng.exe (Microsoft Malware Protection Engine) is the heart of Microsoft Defender Antivirus. It scans files and processes in real time, watches for malicious behavior, and quarantines or removes threats. It runs as a SYSTEM service, and on current Windows it is a protected process (PPL), which keeps other software, even administrators, from reading its memory or injecting into it. Because Defender updates into versioned platform folders, the genuine binary lives under C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe.

Legitimately, MsMpEng runs continuously whenever Defender is the active antivirus, and high CPU during scans is normal. A second copy, a wrong path, or a loss of its protected status is what stands out.

MsMpEng.exe is mostly something to recognize as normal, but it matters in two ways. Its trusted name invites impersonation (T1036.005): a process called MsMpEng.exe outside the Defender platform folder, or one lacking the protected-process status the real engine always has, is suspect.

It is also a target for being switched off (T1685). Attackers disable Defender's real-time protection, stop the service, or add exclusions so the engine stops inspecting their activity, and on hardware that supports it the PPL protection is what makes the engine itself hard to kill or tamper with directly. MsMpEng disappearing, or its protection settings changing, on a machine that is supposed to run Defender means the primary defense has been neutralized.