Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 986622" data-attributes="member: 32260">Recently, I tested Defender against ransomware simulator:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/ransomware-knowbe4-vs-10-avs.113267/post-984441[/URL]It seems that the setting &quot;Cloud Protection Level&quot; = Block, was very efficient against ransomware samples:<ol>
<li data-xf-list-type="ol">Defender Default ---&gt; 12 vulnerable, 2 false positives.</li>
<li data-xf-list-type="ol">Defender Default + Cloud Block Level = Highest ----&gt; 5 vulnerable, 2 false positives.</li>
<li data-xf-list-type="ol">Defender Default + Cloud Block Level = Block ----&gt; 0 vulnerable, 2 false positives.</li>
</ol>Today, I made a false positive test:<ol>
<li data-xf-list-type="ol">Downloaded a few tenth fresh application installers from Softpedia (all uploaded to Softpedia today).</li>
<li data-xf-list-type="ol">These installers were for any kind of applications, including niche/unpopular ones.</li>
<li data-xf-list-type="ol">Tried to install each of them.</li>
</ol>Results:<ul>
<li data-xf-list-type="ul">40% were blocked by SmartScreen</li>
<li data-xf-list-type="ul">30% were blocked by the ASR rule &quot;Block executable files from running unless they meet a prevalence, age, or trusted list criteria&quot;, and one installation by the ASR rule &quot;Use advanced protection against ransomware&quot;.</li>
<li data-xf-list-type="ul">&quot;Cloud Protection Level&quot; = Block, did not block any installation.</li>
</ul>ConclusionIt seems that Microsoft worked hard on decreasing the rate of false positives. This can be seen in the tests of AV-Comparatives and AV-Test from the year 2021. The setting &quot;Cloud Protection Level&quot; = Block, looks well and should not increase much the very good (low) rate of false positives.</blockquote>

[QUOTE="Andy Ful, post: 986622, member: 32260"] Recently, I tested Defender against ransomware simulator: [URL unfurl="false"]https://malwaretips.com/threads/ransomware-knowbe4-vs-10-avs.113267/post-984441[/URL] It seems that the setting "Cloud Protection Level" = Block, was very efficient against ransomware samples: [LIST=1] [*]Defender Default ---> 12 vulnerable, 2 false positives. [*]Defender Default + Cloud Block Level = Highest ----> 5 vulnerable, 2 false positives. [*]Defender Default + Cloud Block Level = Block ----> 0 vulnerable, 2 false positives. [/LIST] Today, I made a false positive test: [LIST=1] [*]Downloaded a few tenth fresh application installers from Softpedia (all uploaded to Softpedia today). [*]These installers were for any kind of applications, including niche/unpopular ones. [*]Tried to install each of them. [/LIST] Results: [LIST] [*]40% were blocked by SmartScreen [*]30% were blocked by the ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", and one installation by the ASR rule "Use advanced protection against ransomware". [*]"Cloud Protection Level" = Block, did not block any installation. [/LIST] Conclusion It seems that Microsoft worked hard on decreasing the rate of false positives. This can be seen in the tests of AV-Comparatives and AV-Test from the year 2021. The setting "Cloud Protection Level" = Block, looks well and should not increase much the very good (low) rate of false positives. [/QUOTE]

Verification