Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 777268" data-attributes="member: 32260">Some posts of [USER=56349]@Lockdown[/USER] and @<a href="https://malwaretips.com/members/evjls-rain.51905/" target="_blank">Evjl&#039;s Rain</a> on the other thread, inspired me to make a test about how can work two combined Windows features: SmartScreen in Edge and &quot;Block at first sight&quot; in WD. This test was performed on Windows 10 Pro 64-bit ver. 1809.<ol>
<li data-xf-list-type="ol">Open ConfigureDefender and use &quot;Defender high settings&quot;.</li>
<li data-xf-list-type="ol">Turn off &quot;Block at first sight&quot; and check if the SmartScreen in Edge is turned on.</li>
<li data-xf-list-type="ol">Restart Windows.</li>
<li data-xf-list-type="ol">Use Edge to open the WD demo webpage <a href="https://demo.wd.microsoft.com/Page/BAFS" target="_blank">Sign in to your account</a> (requires sign in to Microsoft account).</li>
<li data-xf-list-type="ol">Press the blue button &quot;Create &amp; download new file&quot; and let Edge to save this file. Surprisingly, you will not see the SmartScreen alert, despite the fact that the file has been just created, so it is totally unknown to SmartScreen.</li>
<li data-xf-list-type="ol">Reload the web page. Press again the blue button &quot;Create &amp; download new file&quot; to save another new file.</li>
<li data-xf-list-type="ol">Repeat the point 6 a few times to be sure that the saved files are not blocked..</li>
<li data-xf-list-type="ol">Turn on &quot;Block at first sight&quot; feature.</li>
<li data-xf-list-type="ol">Repeat the point 6 a few times. You can see that the files will be blocked and quarantined after download.</li>
</ol>How do I interpret this test?<ol>
<li data-xf-list-type="ol">SmartScreen in Edge does not work in the same way as before Windows 10 ver. 1607, when &quot;Block at first sight&quot; feature was introduced. At present, when the user is going to download the unknown executable, then it is not blocked by SmartScreen.</li>
<li data-xf-list-type="ol">After download via the Edge web browser, OneDrive or another online service which is supported,&nbsp; the unknown executables are checked by &quot;Block at first sight&quot; feature.</li>
<li data-xf-list-type="ol"><s>&quot;Block at first sight&quot; feature, has no impact on the detection of files, after they were executed (dynamic detection).</s></li>
</ol>Post edited - the test will be continued on dynamic detection.</blockquote>

[QUOTE="Andy Ful, post: 777268, member: 32260"] Some posts of [USER=56349]@Lockdown[/USER] and [COLOR=rgb(44, 130, 201)]@[/COLOR][URL='https://malwaretips.com/members/evjls-rain.51905/']Evjl's Rain[/URL] on the other thread, inspired me to make a test about how can work two combined Windows features: SmartScreen in Edge and "Block at first sight" in WD. This test was performed on Windows 10 Pro 64-bit ver. 1809. [LIST=1] [*]Open ConfigureDefender and use "Defender high settings". [*]Turn off "Block at first sight" and check if the SmartScreen in Edge is turned on. [*]Restart Windows. [*]Use Edge to open the WD demo webpage [URL='https://demo.wd.microsoft.com/Page/BAFS']Sign in to your account[/URL] (requires sign in to Microsoft account). [*]Press the blue button "Create & download new file" and let Edge to save this file. Surprisingly, you will not see the SmartScreen alert, despite the fact that the file has been just created, so it is totally unknown to SmartScreen. [*]Reload the web page. Press again the blue button "Create & download new file" to save another new file. [*]Repeat the point 6 a few times to be sure that the saved files are not blocked.. [*]Turn on "Block at first sight" feature. [*]Repeat the point 6 a few times. You can see that the files will be blocked and quarantined after download. [/LIST] How do I interpret this test? [LIST=1] [*]SmartScreen in Edge does not work in the same way as before Windows 10 ver. 1607, when "Block at first sight" feature was introduced. At present, when the user is going to download the unknown executable, then it is not blocked by SmartScreen. [*]After download via the Edge web browser, OneDrive or another online service which is supported, the unknown executables are checked by "Block at first sight" feature. [*][S]"Block at first sight" feature, has no impact on the detection of files, after they were executed (dynamic detection).[/S] [/LIST] Post edited - the test will be continued on dynamic detection. [/QUOTE]

Verification