Just to clear things up (and then I'll go away), if this was the case it would be troubling indeed. When (and if) an AM product scans things deeper that would arise from one area implies that a shorter shrift would be done if the file in question resides somewhere else.
In the case i gave above, if a link is sent through email and this actually did not direct to a website but instead was coded with a Python RAT argument, although perhaps a deeper analytical dive may be instituted if that file was initiated through the browser, but the SAME level of analytics HAS to be applied if that lnk file was run from, say, the Desktop.
If this was not the case the AM product would be what we used to call a "Tuesday Rules" type of product (100% on Tuesdays but not so much on the other days). To avoid this a quality AM product must rely on mechanism detection no matter the location.
