Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 977993" data-attributes="member: 32260">[USER=71496]@Adrian Ścibor[/USER],Something wrong is with Defender&#039;s BAFS feature. It obviously worked in January, March, and May 2021. But, it did not work properly in September 2021 and it did not work at all in January 2022.If BAFS did not work that it is possible that also the cloud backend did not work properly.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />Edit.Until now, I was convinced that the samples did not have MOTW after downloading to disk. So, Defender&#039;s BAFS was ignored but the cloud backend could still work. Yet, from the testing methodology, it follows that the files were downloaded by Google Chrome from the web, so they had to get MOTW. Yet, the BAFS still did not work for some reason. Because the BAFS is a part of the cloud backend, it is possible that the cloud support did not work properly in the current test.It is easy to see if BAFS works or not. When it works, then almost all EXE samples are detected/blocked at Level 1.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 977993, member: 32260"] [USER=71496]@Adrian Ścibor[/USER], Something wrong is with Defender's BAFS feature. It obviously worked in January, March, and May 2021. But, it did not work properly in September 2021 and it did not work at all in January 2022. If BAFS did not work that it is possible that also the cloud backend did not work properly.:unsure: Edit. Until now, I was convinced that the samples did not have MOTW after downloading to disk. So, Defender's BAFS was ignored but the cloud backend could still work. Yet, from the testing methodology, it follows that the files were downloaded by Google Chrome from the web, so they had to get MOTW. Yet, the BAFS still did not work for some reason. Because the BAFS is a part of the cloud backend, it is possible that the cloud support did not work properly in the current test. It is easy to see if BAFS works or not. When it works, then almost all EXE samples are detected/blocked at Level 1.(y) [/QUOTE]

Verification