Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 998527" data-attributes="member: 32260">The way of detecting by Defender the MSI samples is kinda weird.Some samples are automatically quarantined (detected by offline signatures).Some samples are detected later on-execution.Some samples are detected when using Windows built-in unpacker, but are not detected when using 3rd-party unpacker (like 7-Zip). These samples can be detected after unpacking via a manual scan. But, some of them are not auto-quarantined so the user must click the Defender alert and allow to do the cleaning actions. In the meantime, the file is not locked and can be run.So, after downloading the file (and unpacking) it is good to perform a manual scan and if the file is detected, then it is recommendable to click the Defender alert and allow the cleaning.Users should avoid running the file just after the download.Edit.This can be a nightmare when testing many files. It is probable, that some EXE files can behave in a similar way. If so, then most tests with automatic file execution are made improperly.</blockquote>

[QUOTE="Andy Ful, post: 998527, member: 32260"] The way of detecting by Defender the MSI samples is kinda weird. Some samples are automatically quarantined (detected by offline signatures). Some samples are detected later on-execution. Some samples are detected when using Windows built-in unpacker, but are not detected when using 3rd-party unpacker (like 7-Zip). These samples can be detected after unpacking via a manual scan. But, some of them are not auto-quarantined so the user must click the Defender alert and allow to do the cleaning actions. In the meantime, the file is not locked and can be run. [B]So, after downloading the file (and unpacking) it is good to perform a manual scan and if the file is detected, then it is recommendable to click the Defender alert and allow the cleaning. [COLOR=rgb(184, 49, 47)]Users should avoid running the file just after the download.[/COLOR] Edit.[/B] This can be a nightmare when testing many files. It is probable, that some EXE files can behave in a similar way. If so, then most tests with automatic file execution are made improperly. [/QUOTE]

Verification