Software Review Microsoft Defender (Windows 11)

[Shadowra]

Hello

A little feedback on Windows Defender after 1 week of testing on a dedicated virtual machine

Interface UI :

Spoiler

Malware Detection :

Spoiler

Detection Name (it's a Trojan) :

Spoiler

 

[oldschool]

I assume you tested with default settings.

 

[Shadowra]

I assume you tested with default settings.

Yes I just enabled PUA detection for testing purposes.
It blocked them all (they were FakeAV)

 

[oldschool]

Yes I just enabled PUA detection for testing purposes.
It blocked them all (they were FakeAV)

Your test shows that default MD affords good protection and implies that advanced settings are quite powerful when used without other resident security. All of which has been well known to members for some time.

 

[Shadowra]

I pushed further, I had 2 0-day Trojans

The 2 malwares are Trojans that pretend to be a video game. Once launched, a Powershell command is executed to steal the ID and Token of an account in the Discord application (TokenGrab).

At the time of writing, before the test, only Wisevector and Kaspersky blocked the attack.

Here is Microsoft Defender on the 2

1.

Spoiler

2. The file has been deleted contrary to what Microsoft Defender says

Spoiler

So yes, Microsoft Defender can protect you efficiently, and it's free

 

[ForgottenSeer 92963]

In the past I jumped through loops to get a decent protection on XP A light best of freeware breed HIPS do it yourself setup and now I am only using Microsoft Defender (with Configure Defender on MAX like settings) and SRP (with Hard Configurator like Windows_10_Basic_Recommended profile). When you would have told me in 2006 that in 16 years time I would use Microsoft only protection, I would have taken any bet on it that I would not

 

[Shadowra]

In the past I jumped through loops to get a decent protection on XP A light best of freeware breed HIPS do it yourself setup and now I am only using Microsoft Defender (with Configure Defender on MAX like settings) and SRP (with Hard Configurator like Windows_10_Basic_Recommended profile). When you would have told me in 2006 that in 16 years time I would use Microsoft only protection, I would have taken any bet on it that I would not

Everything evolves
Microsoft have made great efforts since the addition of AI Machine Learning, even I am still shocked!

I remember in the past that Microsoft's solutions were bad... (Microsoft Security Essentials on Windows 7 / Windows Defender on Windows 8)

Just this little interface bug that remains annoying when I scan a pack (but since Mrs Michu doesn't get infected by 700 000 malwares per day, I didn't underline it too much)

 

[Andy Ful]

When you would have told me in 2006 that in 16 years time I would use Microsoft only protection, I would have taken any bet on it that I would not

So do I.

 

[Andy Ful]

Everything evolves
Microsoft have made great efforts since the addition of AI Machine Learning, even I am still shocked!

I remember in the past that Microsoft's solutions were bad... (Microsoft Security Essentials on Windows 7 / Windows Defender on Windows 8)

Just this little interface bug that remains annoying when I scan a pack (but since Mrs Michu doesn't get infected by 700 000 malwares per day, I didn't underline it too much)

It seems that MD and Avast are closer in 2021 to the top AVs (in the Consumer Real-World scenario) compared to the period 2019-2020.

REAL-WORLD 2021 (Triathlon = AV-Comparatives + AV-Test + SE Labs) 12 tests
Avast, Microsoft, Kaspersky, Norton ....... 10.5 missed samples
Result rescaled because in the year 2021 there were slightly fewer samples.

Real-World 2019-2020 (Triathlon = AV-Comparatives + AV-Test + SE Labs) 24 tests
--------------------------------- average per 1 year
Norton 360................ 4 missed samples
Kaspersky.................. 9.5 missed samples
Avast, Microsoft...... 18.5 missed samples

 

[Mjolnir]

out of curiosity...are these tests on Home or Pro?....and is core isolation enabled?

 

[Andy Ful]

out of curiosity...are these tests on Home or Pro?....and is core isolation enabled?

These features cannot have any visible impact on the Consumer test results. The differences between Windows Home and Pro are not relevant in these tests. Core Isolation can help to protect the system against malicious drivers and already infected systems against attacks on the Windows kernel.

 

[Mjolnir]

These features cannot have any visible impact on the results.

I know...but i'm a details guy.

 

[Shadowra]

out of curiosity...are these tests on Home or Pro?....and is core isolation enabled?

Windows 11 Pro. Isolation does not work on a virtualized system

 

[Andy Ful]

Windows 11 Pro. Isolation does not work on a virtualized system

It could work if Nested Virtualization is enabled in VM. I tried to turn on Memory Integrity in VM, but it failed due to the incompatible Intel driver (E1G6032E.sys a part of Intel(R) PRO/1000 Adapter). I am not sure what tests @Mjolnir had in mind. In AV Labs tests (from my post) it was Windows 10, but I doubt if Memory Integrity was enabled.

 

[eonline]

Have you tried this app? It is not yet available in my country but maybe in yours it is.

Microsoft Defender - Free download and install on Windows | Microsoft Store

Simplify your online security with one, easy to use app that keeps you and your family safer. Microsoft Defender is a security app for individuals and families that helps protect identities, data, and devices from online threats. The Microsoft Defender app is available exclusively with a...

www.microsoft.com

 

[n8chavez]

Have you tried this app? It is not yet available in my country but maybe in yours it is.

https://www.microsoft.com/en-us/p/m...w/9p6pmztm93lr#activetab=pivot:eek:verviewtab

I can't say I really understand the point of this app. Yes, you can scan your current system/device with this. Yes, you can see other devices you have that have this installed. But no, you cannot scan those other devices or interact with them or even locate them. All you can do is see that those other devices are "protected." It seems half-baked, dumb, or both to me. Stick with Eset mobile, since all this is is a Windows Security gui with no real function of its own.

 

[Shadowra]

Have you tried this app? It is not yet available in my country but maybe in yours it is.

https://www.microsoft.com/en-us/p/m...w/9p6pmztm93lr#activetab=pivot:eek:verviewtab

Not available in my country

 

[Gandalf_The_Grey]

Have you tried this app? It is not yet available in my country but maybe in yours it is.

https://www.microsoft.com/en-us/p/m...w/9p6pmztm93lr#activetab=pivot:eek:verviewtab

It's USA only for the moment.

 

[Andy Ful]

Shadowra,​

I noticed that Defender has got 5 stars in "Network protection". This can be misguiding. The default setup includes Network Inspection System (NIS) implemented via the service NisSrv.exe, but it works differently from what most people understand as Network protection. According to Microsoft it “helps guard against intrusion attempts targeting known and newly discovered vulnerabilities in network protocols.”
The normal "Network protection" is available in Defender only in advanced (non-default) settings.

 

[ForgottenSeer 69673]

I can't say I really understand the point of this app. Yes, you can scan your current system/device with this. Yes, you can see other devices you have that have this installed. But no, you cannot scan those other devices or interact with them or even locate them. All you can do is see that those other devices are "protected." It seems half-baked, dumb, or both to me. Stick with Eset mobile, since all this is is a Windows Security gui with no real function of its own.

I agree as to what is so special about this app? Installed it yesterday so added some screen shots. I also installed the Microsoft Defender App Guard but since I am trying out a inactivated Win 10 Enterprise, I can't check the program or personalize this OS.