Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 987732" data-attributes="member: 32260">In my previous post, I suggested that the &quot;Zero tolerance&quot; blocking level can also block files after they have been submitted to the cloud backend.&nbsp; To be sure I tested this behavior on Windows Pro, Windows Server 2019, and Windows 10 Enterprise.<ol>
<li data-xf-list-type="ol">Cloud Protection Level was set to &quot;Zero tolerance&quot; (Block setting in ConfigureDefender).</li>
<li data-xf-list-type="ol">Defender&#039;s Automatic Sample Submission was set to AlwaysPrompt. When this setting is applied, the Windows Security Center claims that &quot;Automatic sample submission is off &quot;, so submissions are not automatical - the user is prompted for consent.</li>
<li data-xf-list-type="ol">I used KnowBe4 ransomware simulator to run suspicious samples.</li>
<li data-xf-list-type="ol">A similar test was done with Automatic Sample Submission set to SendSafeSamples (samples without user privacy content are submitted automatically, others are prompted).</li>
</ol>With the AlwaysPrompt setting, Defender still prompted sometimes to submit unknown *.cxp files and some AMSI streams used by the simulator to run ransomware.With the SendSafeSamples setting, Defender showed the alerts that file execution had to be postponed for some seconds (Security scan required) - this alert is related to submitting files to the cloud backend. Also, the submission prompts for AMSI streams were displayed.So actually, the &quot;Zero tolerance&quot; blocking level does not differ significantly from other blocking levels and the decision that the file is finally unknown &amp; suspicious can be done after the file submission &amp; analysis by the cloud backend.Here is an updated chart :[ATTACH=full]266457[/ATTACH]The blocking levels High, High+, Zero tolerance (or High, Highest, Block in ConfigureDefender) can have an impact on the final &quot;Negative Verdict before defined timeout&quot; marked in red on the above chart.</blockquote>

[QUOTE="Andy Ful, post: 987732, member: 32260"] In my previous post, I suggested that the "Zero tolerance" blocking level can also block files after they have been submitted to the cloud backend. To be sure I tested this behavior on Windows Pro, Windows Server 2019, and Windows 10 Enterprise. [LIST=1] [*]Cloud Protection Level was set to "Zero tolerance" (Block setting in ConfigureDefender). [*]Defender's Automatic Sample Submission was set to AlwaysPrompt. When this setting is applied, the Windows Security Center claims that "Automatic sample submission is off ", so submissions are not automatical - the user is prompted for consent. [*]I used KnowBe4 ransomware simulator to run suspicious samples. [*]A similar test was done with Automatic Sample Submission set to SendSafeSamples (samples without user privacy content are submitted automatically, others are prompted). [/LIST] With the AlwaysPrompt setting, Defender still prompted sometimes to submit unknown *.cxp files and some AMSI streams used by the simulator to run ransomware. With the SendSafeSamples setting, Defender showed the alerts that file execution had to be postponed for some seconds (Security scan required) - this alert is related to submitting files to the cloud backend. Also, the submission prompts for AMSI streams were displayed. So actually, the "Zero tolerance" blocking level does not differ significantly from other blocking levels and the decision that the file is finally unknown & suspicious can be done after the file submission & analysis by the cloud backend. Here is an updated chart : [ATTACH type="full" alt="1652046689976.png"]266457[/ATTACH] The blocking levels High, High+, Zero tolerance (or High, Highest, Block in ConfigureDefender) can have an impact on the final "Negative Verdict before defined timeout" marked in red on the above chart. [/QUOTE]

Verification