Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 902261" data-attributes="member: 32260">The ConfigureDefender HIGH Protection Level makes Defender more aggressive for PE files (EXE, DLL, etc.) and much more preventive for scripts and macros. When you will use it with Edge (SmartScreen + PUA enabled) then such configuration will be among the top commercial AVs (even tweaked) for home users in the Real-World scenario (web browser and email threats).When you will use it for running PE malware from USB drives, then the protection will also be among the top AVs (due to one of ASR rules). But, when you will first copy the PE file from the USB drive to HDD and run it from HDD, then WD will use only the more aggressive detection threshold level (no ASR, no BAFS ). So, the detection will be higher as compared to default settings, but I am not sure if it will be among the top AVs or not. It would be interesting to test this on MH.When you will enable all ASR rules, then you will get the top protection in the category of home products, but the number of false positives will increase (especially for fresh updates).<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />Edit.It is worth remembering that WD is cloud-dependent, so its offline detection is not great. This can be important in businesses.</blockquote>

[QUOTE="Andy Ful, post: 902261, member: 32260"] The ConfigureDefender HIGH Protection Level makes Defender more aggressive for PE files (EXE, DLL, etc.) and much more preventive for scripts and macros. When you will use it with Edge (SmartScreen + PUA enabled) then such configuration will be among the top commercial AVs (even tweaked) for home users in the Real-World scenario (web browser and email threats). When you will use it for running [B][COLOR=rgb(184, 49, 47)]PE malware[/COLOR][/B] from USB drives, then the protection will also be among the top AVs (due to one of ASR rules). But, when you will first copy the PE file from the USB drive to HDD and run it from HDD, then WD will use only the more aggressive detection threshold level (no ASR, no BAFS ). So, the detection will be higher as compared to default settings, but I am not sure if it will be among the top AVs or not. It would be interesting to test this on MH. When you will enable all ASR rules, then you will get the top protection in the category of home products, but the number of false positives will increase (especially for fresh updates).(y) Edit. It is worth remembering that WD is cloud-dependent, so its offline detection is not great. This can be important in businesses. [/QUOTE]

Verification