App Review Microsoft Defender Antivirus + Windows 11 Smart App Control (SAC)

It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
Content created by
Shadowra

Shadowra

Level 36
Thread author
Verified
Top Poster
Content Creator
Malware Tester
Well-known
Sep 2, 2021
2,582
Microsoft Defender is the antivirus system developed by Microsoft since Windows 8.
Formerly called Windows Defender (and Microsoft Security Essentials on Windows 7 and even Windows Live OneCare before that! ) Windows antivirus has never shone.
But since Windows 10, Microsoft has bounced back to become a very popular antivirus.
On Windows 11, Microsoft has included SAC (Smart App Control), which blocks unknown applications (like Avast's Hardened Mode) as well as a few risky actions.
Let's see if Microsoft keeps its promises.

\!/ Microsoft Defender is set to default!



User interface :
The Microsoft Defender Security Center interface is very simple to use and easy to find.
Since it's a major security brick, it's got it all (Firewall, Antivirus, Smart App Control, anti-ransomware protection with file recovery through OneDrive, Web filtering with SmartScreen, etc.).

Web protection: 12/12
Microsoft Defender blocks all malicious links and downloads.
Note that I did this test via Microsoft Edge to stay on the Microsoft eco-system... There is, however, an extension called Microsoft Defender Browser Protection for Chrome.

Fake crack : 1/1
During launch, we can see that SAC prevents malware from being launched.
But after execution, Microsoft Defender also removes the files. There's good consistency.

Malware Pack : Remaining 7 files out of 152.
Microsoft Defender is very efficient at detecting malware.
Smart App Control also protects and makes up for the mistakes made by Microsoft Defender by blocking malware that was in .MSI files.
However, 2 pieces of malware managed to install themselves (StrRat in Java and AlteraAgent, which is signed).
The machine can be disinfected.

Final scan :
Microsoft : 0
NPE : 0
MBAM : 0
KVRT : 2

Final opinion:

Microsoft provides excellent protection.
Microsoft Defender has made great strides over the years to become a high-performance antivirus.
Smart App Control adds extra protection and can block malware.
However, Smart App Control will be totally ineffective on malware with a valid signature and on Java/VBS/JS attacks. It will be Microsoft Defender's job to block the file.
Recommended protection.
 

Bot

AI-powered Bot
Apr 21, 2016
4,315
Thanks for the comprehensive review! It's great to see that Microsoft Defender and Windows 11's Smart App Control (SAC) are providing robust security measures. The interface simplicity and efficiency in malware detection are commendable. However, the point on SAC's ineffectiveness on malware with valid signatures and Java/VBS/JS attacks is noteworthy. It's clear that while SAC adds an extra layer of protection, Microsoft Defender remains crucial in blocking potential threats.
 

Shadowra

Level 36
Thread author
Verified
Top Poster
Content Creator
Malware Tester
Well-known
Sep 2, 2021
2,582
Thanks for the comprehensive review! It's great to see that Microsoft Defender and Windows 11's Smart App Control (SAC) are providing robust security measures. The interface simplicity and efficiency in malware detection are commendable. However, the point on SAC's ineffectiveness on malware with valid signatures and Java/VBS/JS attacks is noteworthy. It's clear that while SAC adds an extra layer of protection, Microsoft Defender remains crucial in blocking potential threats.

Microsoft Defender can block signed files and Java/JS/VBS attacks, but only if its database or cloud knows about them.
But yes, in 0-day, it can pass (like any antivirus, in fact... no antivirus is infallible). ;)
 

Bot

AI-powered Bot
Apr 21, 2016
4,315
Microsoft Defender can block signed files and Java/JS/VBS attacks, but only if its database or cloud knows about them.
But yes, in 0-day, it can pass (like any antivirus, in fact... no antivirus is infallible). ;)
Absolutely, no antivirus software is perfect, and they all have their strengths and weaknesses. It's reassuring to know that Microsoft Defender can block signed files and Java/JS/VBS attacks if they are known in its database or cloud. It's also a good reminder that new, unknown threats (0-day) can slip through, highlighting the importance of regular updates and safe online practices.
 

aftech

Level 1
Dec 6, 2023
23
Microsoft Defender is the antivirus system developed by Microsoft since Windows 8.
Formerly called Windows Defender (and Microsoft Security Essentials on Windows 7 and even Windows Live OneCare before that! ) Windows antivirus has never shone.
But since Windows 10, Microsoft has bounced back to become a very popular antivirus.
On Windows 11, Microsoft has included SAC (Smart App Control), which blocks unknown applications (like Avast's Hardened Mode) as well as a few risky actions.
Let's see if Microsoft keeps its promises.

\!/ Microsoft Defender is set to default!



User interface :
The Microsoft Defender Security Center interface is very simple to use and easy to find.
Since it's a major security brick, it's got it all (Firewall, Antivirus, Smart App Control, anti-ransomware protection with file recovery through OneDrive, Web filtering with SmartScreen, etc.).

Web protection: 12/12
Microsoft Defender blocks all malicious links and downloads.
Note that I did this test via Microsoft Edge to stay on the Microsoft eco-system... There is, however, an extension called Microsoft Defender Browser Protection for Chrome.

Fake crack : 1/1
During launch, we can see that SAC prevents malware from being launched.
But after execution, Microsoft Defender also removes the files. There's good consistency.

Malware Pack : Remaining 7 files out of 152.
Microsoft Defender is very efficient at detecting malware.
Smart App Control also protects and makes up for the mistakes made by Microsoft Defender by blocking malware that was in .MSI files.
However, 2 pieces of malware managed to install themselves (StrRat in Java and AlteraAgent, which is signed).
The machine can be disinfected.

Final scan :
Microsoft : 0
NPE : 0
MBAM : 0
KVRT : 2

Final opinion:

Microsoft provides excellent protection.
Microsoft Defender has made great strides over the years to become a high-performance antivirus.
Smart App Control adds extra protection and can block malware.
However, Smart App Control will be totally ineffective on malware with a valid signature and on Java/VBS/JS attacks. It will be Microsoft Defender's job to block the file.
Recommended protection.

That's why adding app locker to the aresenal for blocking scripts outside system space is mandatory.
 

cartaphilus

Level 10
Verified
Well-known
Mar 17, 2023
496
That's why adding app locker to the aresenal for blocking scripts outside system space is mandatory.
what app locker do you use/recommend?

Sidenote: One solid example that humans are asshole species is from the pure fact that we don't let sleeping dogs lay. For example each time my dog sleeps comfortably I just have an extreme desire to hug and pet him.
 
F

ForgottenSeer 114834

Microsoft Defender is the antivirus system developed by Microsoft since Windows 8.
Formerly called Windows Defender (and Microsoft Security Essentials on Windows 7 and even Windows Live OneCare before that! ) Windows antivirus has never shone.
But since Windows 10, Microsoft has bounced back to become a very popular antivirus.
On Windows 11, Microsoft has included SAC (Smart App Control), which blocks unknown applications (like Avast's Hardened Mode) as well as a few risky actions.
Let's see if Microsoft keeps its promises.

\!/ Microsoft Defender is set to default!



User interface :
The Microsoft Defender Security Center interface is very simple to use and easy to find.
Since it's a major security brick, it's got it all (Firewall, Antivirus, Smart App Control, anti-ransomware protection with file recovery through OneDrive, Web filtering with SmartScreen, etc.).

Web protection: 12/12
Microsoft Defender blocks all malicious links and downloads.
Note that I did this test via Microsoft Edge to stay on the Microsoft eco-system... There is, however, an extension called Microsoft Defender Browser Protection for Chrome.

Fake crack : 1/1
During launch, we can see that SAC prevents malware from being launched.
But after execution, Microsoft Defender also removes the files. There's good consistency.

Malware Pack : Remaining 7 files out of 152.
Microsoft Defender is very efficient at detecting malware.
Smart App Control also protects and makes up for the mistakes made by Microsoft Defender by blocking malware that was in .MSI files.
However, 2 pieces of malware managed to install themselves (StrRat in Java and AlteraAgent, which is signed).
The machine can be disinfected.

Final scan :
Microsoft : 0
NPE : 0
MBAM : 0
KVRT : 2

Final opinion:

Microsoft provides excellent protection.
Microsoft Defender has made great strides over the years to become a high-performance antivirus.
Smart App Control adds extra protection and can block malware.
However, Smart App Control will be totally ineffective on malware with a valid signature and on Java/VBS/JS attacks. It will be Microsoft Defender's job to block the file.
Recommended protection.

Wow does this mean with built in security and good habits one can be relatively safe online? 🤯 Say it isn't so. Think of that tight integration into the OS as well, less bugs/vulnerabilities added and more stability. What a concept you have demonstrated here today.
 

Shadowra

Level 36
Thread author
Verified
Top Poster
Content Creator
Malware Tester
Well-known
Sep 2, 2021
2,582
Wow does this mean with built in security and good habits one can be relatively safe online? 🤯 Say it isn't so. Think of that tight integration into the OS as well, less bugs/vulnerabilities added and more stability. What a concept you have demonstrated here today.

I don't think I quite understand what you mean.
This protection is effective.
With common sense and, above all, prevention, you can protect yourself without paying for another service.
 
F

ForgottenSeer 114834

Wow, Microsoft is killing it. It just needs some kind of behavior blocker then it can be a strong contender against 3rd party antivirus.
So much misconception amongst these threads. What do you think the odds are of an actual user coming into contact with that much malware especially in one shot? Let's take a daily driver with those settings and good habits, as well as contingencies such as images and backups of personal on external.

Now let's add in the fact the security is built in, integrated into the OS, and therefore does not add additional bugs and vulnerability that a 3rd party application does, and then ask yourself, are you sure you have the correct perspective of this.
 

aftech

Level 1
Dec 6, 2023
23
what app locker do you use/recommend?

Sidenote: One solid example that humans are asshole species is from the pure fact that we don't let sleeping dogs lay. For example each time my dog sleeps comfortably I just have an extreme desire to hug and pet him.
Windows built-in applocker; blocking scripts and unsigned executables in the user space. It can partially replace SAC with the advantage of customizability.
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,458
@Shadowra,

It looks like you used WinRar with an option to skip MotW. This caused the execution of LNK malware.
The older versions of WinRar used to skip MotW, but the current version (7.01) preserves MotW by default (Settings >> Security >> Propagate Mark of the Web). It is also true for Explorer, 7-ZIP, Bandizip, Explzh, Nanazip, and Peazip).

In most cases (at home), the LNK malware will have MotW and SAC can block such files by default. The same is true for scripts, scriptlets, and other unsafe file types:
  • appref-ms
  • .appx
  • .appxbundle
  • .Bat
  • .Chm
  • .Cmd
  • .com
  • .Cpl
  • .dll
  • .drv
  • .gadget
  • .hta
  • .ISO
  • .Js
  • .jse
  • . lnk
  • .Msc
  • .Msp
  • .ocx
  • .pif
  • .ppkg
  • .printerexport
  • .ps1
  • .rdp
  • .Reg
  • .Scf
  • .Scr
  • .settingcontent-ms
  • .sys
  • .url
  • .Vb
  • .vbe
  • .vbs
  • .Vhd
  • .vhdx
  • .vxd
  • .website
  • .wsf
  • .wsh.

Edit 1.
The attack with LNK malware could succeed in the wild when performed via a flash drive (non-NTFS format). The MotW is skipped when the file is copied to non-NTFS drive.

Edit 2.
I removed WinZip, because I am not sure which file types are supported.
 
Last edited:
F

ForgottenSeer 114834

@Shadowra,

It looks like you used WinRar with an option to skip MotW. This caused the execution of LNK malware.
The older versions of WinRar used to skip MotW, but the current version preserves MotW by default (it is also true for Explorer, 7-ZIP, Bandizip, Nanazip, Peazip, WinZip, etc.).

In most cases (at home), the LNK malware will have MotW and SAC can block such files by default. The same is true for scripts, scriptlets, and other unsafe file types:
  • appref-ms
  • .appx
  • .appxbundle
  • .Bat
  • .Chm
  • .Cmd
  • .com
  • .Cpl
  • .dll
  • .drv
  • .gadget
  • .hta
  • .ISO
  • .Js
  • .jse
  • . lnk
  • .Msc
  • .Msp
  • .ocx
  • .pif
  • .ppkg
  • .printerexport
  • .ps1
  • .rdp
  • .Reg
  • .Scf
  • .Scr
  • .settingcontent-ms
  • .sys
  • .url
  • .Vb
  • .vbe
  • .vbs
  • .Vhd
  • .vhdx
  • .vxd
  • .website
  • .wsf
  • .wsh.

Edit
The attack with LNK malware could succeed in the wild when performed via a flash drive (non-NTFS format). The MotW is skipped when the file is copied to non-NTFS drive.
Are you stating that when a true route of infection is presented that security products such as the built in one will respond differently?
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top