New Update Smart App Control - Windows 11 22H2 feature promises significant protection from malware

[Parkinsond]

SAC in action, finally

 

[oldschool]

User tip: If SAC blocks an app or part of an app, e.g. Ungoogled Chromium, disable SAC and Optional Diagnostic Data. Then go about your business, enable both after a little while and then open the blocked app. This worked for me at least so far with UG Chromium.

 

[oldschool]

@Andy Ful - I continue to wonder about the inner workings of SAC. Network access for UG Chromium was blocked again after multiple Chrome Web Store extension update alerts and subsequent installation. My guess is that it objected to all the network activity. No more blocks after disabling and re-enabling SAC. Subsequent extension updates have proceeded normally since.

It appears that SAC has some behavior monitoring capability.

 

[Marko :)]

I used SAC but it started to get too many false positives so I had to disable it.

 

[Parkinsond]

behavior

Heuristic, rather than behavioral.

 

[Andy Ful]

@Andy Ful - I continue to wonder about the inner workings of SAC. Network access for UG Chromium was blocked again after multiple Chrome Web Store extension update alerts and subsequent installation. My guess is that it objected to all the network activity. No more blocks after disabling and re-enabling SAC. Subsequent extension updates have proceeded normally since.

It appears that SAC has some behavior monitoring capability.

SAC is a pre-execution feature integrated with Microsoft ISG. SAC alone does not include behavior monitoring, but it sends some telemetry to ISG.
So, SAC + Microsoft ISG can have some behavior monitoring capability. ISG's AI makes the final decision about blocking unsigned & unknown executables.

Edit.
The events noted by you could also relate to ISG Big Data analysis based on file prevalence, which can change significantly in a short time for popular applications.