Reply to thread

Message

<blockquote data-quote="oldschool" data-source="post: 836783" data-attributes="member: 71262">Weak local signatures are the reason for the low static detection. The real time detection uses the cloud which is WD&#039;s strong point. The main detection difference between High and Max settings are the the blocking level and the number of ASR rules enabled. One sample&quot;E6425863124892_460722.js opens wscript.exe and the payload is blocked by two ASR rule&quot;. One of these ASR rules &quot;Block executables unless they meet a prevalence, age or trusted criteria&quot; would not have been enabled in High setting. I am not sure whether it would have been a block, partial block, etc.&nbsp; with only the one rule &quot;Use advanced protection against ransomware&quot; instead of two.Remember, you can enable all of these using High and manually select&nbsp; the additional ASR rules, blocking level, cloud timeout, etc. unless you encounter an ASR rule incompatibility with your system that does not allow exclusions.Edited: last sentence.</blockquote>

[QUOTE="oldschool, post: 836783, member: 71262"] Weak local signatures are the reason for the low static detection. The real time detection uses the cloud which is WD's strong point. The main detection difference between High and Max settings are the the blocking level and the number of ASR rules enabled. One sample "E6425863124892_460722.js opens wscript.exe and the payload is blocked by two ASR rule". One of these ASR rules "Block executables unless they meet a prevalence, age or trusted criteria" would [I]not[/I] have been enabled in High setting. I am not sure whether it would have been a block, partial block, etc. with only the one rule "Use advanced protection against ransomware" instead of two. Remember, you can enable all of these using High and manually select the additional ASR rules, blocking level, cloud timeout, etc. unless you encounter an ASR rule incompatibility with your system that does not allow exclusions. Edited: last sentence. [/QUOTE]

Verification