Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1032261" data-attributes="member: 32260">Defender on MAX allowed unsigned DLLs because it did not check them. In some situations, a few ASR rules can check DLLs by behavior rules (like with the ASR rule &quot;Use advanced protection against ransomware&quot;). SAC can check all loaded DLLs (via standard APIs). Generally, SAC will produce far more false positives for DLLs compared to Defender on MAX.I think that Defender on MAX can be used with SAC. Both can support each other. Their protection overlaps mostly on EXE files, but even there we can see some important differences. For example, Defender on MAX can block some digitally signed EXE malware (by prevalence) that could be allowed by SAC. On the other side, SAC can block unsigned malware without cloud backend or when malware has got a big file size (not checked by Defender due to file size limit).Yes, using SRP is clearly beneficial at home. But this usually requires a home administrator. Many people can probably use SAC + Defender on MAX and choose a simple software setup based on well-signed and popular applications. If they will not change that setup, then everything will probably work well. Of course, such a security setup will be not good for many people too (there will be problems with games, etc.)When using the H_C, it is unimportant which popular AV is installed. The concrete H_C setup can mostly depend on the home administrator&#039;s preferences.</blockquote>

[QUOTE="Andy Ful, post: 1032261, member: 32260"] Defender on MAX allowed unsigned DLLs because it did not check them. In some situations, a few ASR rules can check DLLs by behavior rules (like with the ASR rule "Use advanced protection against ransomware"). SAC can check all loaded DLLs (via standard APIs). Generally, SAC will produce far more false positives for DLLs compared to Defender on MAX. I think that Defender on MAX can be used with SAC. Both can support each other. [B]Their protection overlaps mostly on EXE files[/B], but even there we can see some important differences. For example, Defender on MAX can block some digitally signed EXE malware (by prevalence) that could be allowed by SAC. On the other side, SAC can block unsigned malware without cloud backend or when malware has got a big file size (not checked by Defender due to file size limit). Yes, using SRP is clearly beneficial at home. But this usually requires a home administrator. Many people can probably use SAC + Defender on MAX and choose a simple software setup based on well-signed and popular applications. If they will not change that setup, then everything will probably work well. Of course, such a security setup will be not good for many people too (there will be problems with games, etc.) When using the H_C, it is unimportant which popular AV is installed. The concrete H_C setup can mostly depend on the home administrator's preferences. [/QUOTE]

Verification