Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 935128" data-attributes="member: 32260">The whitelisting made by the Microsoft analyst strongly suggests that AMSI-paired ML detections are just like other behavior-based detections, as @[USER=86910]struppigel[/USER] suggested (I will make an additional test to confirm this). From your own test, it follows that whitelisting one script (antimalware detection) does not whitelist the modified scripts. From my tests, it follows that whitelisting one of AMSI-paired ML detections for the same script does not automatically whitelist another possible AMSI-paired ML detection.Furthermore, your scripts are also blocked by ASR rules. ASR exclusions also do not automatically whitelist modified scripts.Anyway.It is true that many commercial (paid) AVs can provide a more flexible way of anti-ransomware protection than Defender on default settings + Controlled Folder Access. So, if you need more flexibility you can use one of them or learn to use Windows built-in security.</blockquote>

[QUOTE="Andy Ful, post: 935128, member: 32260"] The whitelisting made by the Microsoft analyst strongly suggests that AMSI-paired ML detections are just like other behavior-based detections, as @[USER=86910]struppigel[/USER] suggested (I will make an additional test to confirm this). From your own test, it follows that whitelisting one script (antimalware detection) does not whitelist the modified scripts. From my tests, it follows that whitelisting one of AMSI-paired ML detections for the same script does not automatically whitelist another possible AMSI-paired ML detection. Furthermore, your scripts are also blocked by ASR rules. ASR exclusions also do not automatically whitelist modified scripts. Anyway. It is true that many commercial (paid) AVs can provide a more flexible way of anti-ransomware protection than Defender on default settings + Controlled Folder Access. So, if you need more flexibility you can use one of them or learn to use Windows built-in security. [/QUOTE]

Verification