Reply to thread

Message

<blockquote data-quote="Lenny_Fox" data-source="post: 853028" data-attributes="member: 82776">That is why I added them to the sponsors blocked (in the profile posted above). Did I do something wrong?My assumption was based on discussion in reddit (where MS people had participated) and the official Microsoft documentation. Allow me&nbsp; to write down on how I understood&nbsp; this so you can correct it:Block at first sight applies to executables and&nbsp; non-portable executable files (such as JS, VBS, or macros) applies only when they have the Mark Of The Web (are downloaded from the internet by a browser which sets the MOTW).ASR rule Block executable files from running unless they meet a prevalence, age, or trusted list criteria applies to ALL executablesCloud delivered protection level Zero Tolerance (your block option)Block at first sight and cloud delivered protection level are mentioned explicitly as two different mechanisms (<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus" target="_blank">link Microsoft</a>)? In the documentation of Block at first sight the reference to MOTW only is explained explicitly. While this is not mentioned explicitly at Cloud Protection Level. These settings are controlled by two different settings in group policy. That is why I assumed Cloud Protection Level applies to all executables.</blockquote>

[QUOTE="Lenny_Fox, post: 853028, member: 82776"] That is why I added them to the sponsors blocked (in the profile posted above). Did I do something wrong? My assumption was based on discussion in reddit (where MS people had participated) and the official Microsoft documentation. Allow me to write down on how I understood this so you can correct it: [B]Block at first sight[/B] applies to executables and non-portable executable files (such as JS, VBS, or macros) applies only when they have the Mark Of The Web (are downloaded from the internet by a browser which sets the MOTW). [B]ASR rule [/B]Block executable files from running unless they meet a prevalence, age, or trusted list criteria applies to ALL executables [B]Cloud delivered protection level Zero Tolerance (your block option)[/B] Block at first sight and cloud delivered protection level are mentioned explicitly as two different mechanisms ([URL='https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus']link Microsoft[/URL])? In the documentation of Block at first sight the reference to MOTW only is explained explicitly. While this is not mentioned explicitly at Cloud Protection Level. These settings are controlled by two different settings in group policy. That is why I assumed Cloud Protection Level applies to all executables. [/QUOTE]

Verification