ConfigureDefender utility for Windows 10/11

[Andy Ful]

...
WD is still weak at signature based detection, they are late at creating signatures but their investment in the cloud is being paid of.

They do not haste with signatures to keep a low rate of false positives in Enterprises. Many computers in Enterprises are connected to Intranet and have not got an Internet connection.
False positives in such a network can be more dangerous than malware. The computers which have the Internet connection are more vulnerable so they have to be protected by more aggressive and fast detection of WD cloud.

 

[blueblackwow65]

Does WD with configuredefender and VS work well together? I also seen like serioushoax that detection was slow a bit .

 

[SeriousHoax]

They do not haste with signatures to keep a low rate of false positives in Enterprises. Many computers in Enterprises are connected to Intranet and have not got an Internet connection.
False positives in such a network can be more dangerous than malware. The computers which have the Internet connection are more vulnerable so they have to be protected by more aggressive and fast detection of WD cloud.

Interesting.

 

[shmu26]

Does WD with configuredefender and VS work well together? I also seen like serioushoax that detection was slow a bit .

In my experience, it works well together. I never heard anyone complaining about that combo.

 

[oldschool]

Does WD with configuredefender and VS work well together? I also seen like serioushoax that detection was slow a bit .

Definitely. Just understand how VS works and it can run very silently.

 

[SeriousHoax]

Hi, Andy Ful
Any idea about this? I've seen this twice today for the very first time

 

[Andy Ful]

Hi, Andy Ful
Any idea about this? I've seen this twice today for the very first time
View attachment 225197

There can be many sources of this alert. It is probably a false positive, when you use 3rd party application which uses a service to do something on disk. In rare cases, it can be also a malware hiding under svchost.
If you can find out the application which uses a service to something in Video folder, then you can probably exclude this folder in that application.
Do you use SCPToolkit?

 

[SeriousHoax]

There can be many sources of this alert. It is probably a false positive, when you use 3rd party application which uses a service to do something on disk. In rare cases, it can be also a malware hiding under svchost.

Hmm probably a false positive as there shouldn't be any malware on my system. But I'll do some scanning.
Here's another strange one related to Ccleaner about accessing protected memory. Notified the last two time I opened CCleaner but never before. CCleaner hasn't been updated either.

 

[Andy Ful]

Hmm probably a false positive as there shouldn't be any malware on my system. But I'll do some scanning.
Here's another strange one related to Ccleaner about accessing protected memory. Notified the last two time I opened CCleaner but never before. CCleaner hasn't been updated either.
View attachment 225202

That is normal for such applications. Similar issues were observed when using Hard Disk Sentinel. Just exclude CCleaner64.exe in Controlled Folder Access.

 

[SeriousHoax]

That is normal for such applications. Similar issues were observed when using Hard Disk Sentinel. Just exclude CCleaner64.exe in Controlled Folder Access.

Ok thanks

 

[oldschool]

@Andy Ful or other members, can you please comment on this Wilders' post, especially the last phrase? Windows Defender Is Becoming the Powerful Antivirus That Windows 10 Needs

If malware can never run, then you don't need any security tools. But you should always cover all kinds of scenarios. What if you get tricked into running malware? Then AV and behavior blocker should come into action. And I don't believe that Win Def has got any behavior blocker, so once malware is allowed to run, it's indeed game over, but feel free to correct me.

Edit: added italics.

 

[notabot]

@Andy Ful or other members, can you please comment on this Wilders' post? Windows Defender Is Becoming the Powerful Antivirus That Windows 10 Needs

ASR is behaviour blocking, exploit Guard rules is also behaviour blocking, I'd like to see a more expanded ruleset ( hence my other thread on behaviour blockers ) but it's not like WD doesn't have any.

 

[Andy Ful]

@Andy Ful or other members, can you please comment on this Wilders' post? Windows Defender Is Becoming the Powerful Antivirus That Windows 10 Needs

The guy believes in something. He does not say that he knows how WD works and what is the reason for his beliefs. He does not say that we must share his beliefs. Everyone has the right to have personal beliefs which do not hurt others.

 

[oldschool]

The guy believes in something. He does not say that he knows how WD works and what is the reason for his beliefs. He does not say that we must share his beliefs. Everyone has the right to have personal beliefs which do not hurt others.

Yes, I realize this but I was asking for a more detailed or expanded description of WD behavior-blocking features. I ask for my own education and not to debate or defeat the OP.

 

[blackice]

The guy believes in something. He does not say that he knows how WD works and what is the reason for his beliefs. He does not say that we must share his beliefs. Everyone has the right to have personal beliefs which do not hurt others.

He has many strong opinions, some popular, some not so much. It fosters discussion.

 

[Andy Ful]

ASR is behaviour blocking, exploit Guard rules is also behaviour blocking, I'd like to see a more expanded ruleset ( hence my other thread on behaviour blockers ) but it's not like WD doesn't have any.

Yes, I realize this but I was asking for a more detailed or expanded description of WD behavior-blocking features. I ask for my own education and not to debate or defeat the OP.

Like most modern AVs, WD has behavior blocking capabilities included in Machine Learning models (locally and in the cloud). The ASR, Exploit Guard, Controlled Folder Access and other WD features are just extensions of it.

 

[oldschool]

Like most modern AVs, WD has behavior blocking capabilities included in Machine Learning models (locally and in the cloud). The ASR, Exploit Guard, Controlled Folder Access and other WD features are just extensions of it.

Thanks. That was my general understanding.

 

[Andy Ful]

The term 'Behavior Blocker' is not clear nowadays. So it is hard to comment if someone uses it.
I posted about it in the thread:

What Behavior Blocker is, and what it is not.

I read many posts on MT forum and some other forums about using Behavior Blockers. It seems that there is no general agreement on what are the capabilities of Behavior Blocker (BB) and which AVs use Behavior Blockers (BBs). So, I made a little research to clarify this. I did not find any widely...

malwaretips.com

Many vendors use the term behavior-based detections, behavior-based heuristics, etc..
For example, behavior-based features are used by Windows Defender (behavior-based ML, AMSI ML), Trend Micro (OfficeScan), Symantec (Sonar), Kaspersky (System Watcher), F-Secure (DeepGuard), Eset (DNA), BitDefender (Advanced Threat Defense), Avast (Behavior Shield).

 

[notabot]

Like most modern AVs, WD has behavior blocking capabilities included in Machine Learning models (locally and in the cloud). The ASR, Exploit Guard, Controlled Folder Access and other WD features are just extensions of it.

Isn't machine learning part of ATP only ? or you've found a way unlock yet another enterprise feature for home/pro users (at least locally)

 

[oldschool]

Isn't machine learning part of ATP only ? or you've found a way unlock yet another enterprise feature for home/pro users (at least locally)

Microsoft's foggy technical literature make it difficult to determine exactly which features of ATP make it into WD. @Nightwalker posted this @ Wilders: Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV - Microsoft Security