Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1058092" data-attributes="member: 32260">Yes.Testing ISG was not easy. I tested it as follows:<ol>
<li data-xf-list-type="ol">Prepared over 150 executables/installers/portable applications on the flash drive (FAT 32), that were never executed on my computer with active WDAC ISG. 
Keeping the executables on FAT 32 flash drive removes any MOTW.</li>
<li data-xf-list-type="ol">Turned OFF Microsoft Defender real-time protection, Cloud-delivered protection, and Automatic sample submission.</li>
<li data-xf-list-type="ol">Executed files from the flash drive - almost all were blocked (~ 95%).</li>
<li data-xf-list-type="ol">Turned ON Microsoft Defender.</li>
<li data-xf-list-type="ol">Restarted the computer.</li>
<li data-xf-list-type="ol">Executed files again - about 60% were allowed.</li>
<li data-xf-list-type="ol">Turned OFF Microsoft Defender real-time protection, Cloud-delivered protection, and Automatic sample submission (like in point 2).</li>
<li data-xf-list-type="ol">Restarted the computer.</li>
<li data-xf-list-type="ol">Executed files again - about 60% were allowed, despite the fact that Microsoft Defender was disabled.</li>
</ol>Conclusion.If the file were successfully executed with ISG and Microsoft Defender, this is somehow remembered in the system (at least for some time).</blockquote>

[QUOTE="Andy Ful, post: 1058092, member: 32260"] Yes. Testing ISG was not easy. I tested it as follows: [LIST=1] [*]Prepared over 150 executables/installers/portable applications on the flash drive (FAT 32), [B][COLOR=rgb(184, 49, 47)]that were never executed on my computer with active WDAC ISG.[/COLOR][/B] Keeping the executables on FAT 32 flash drive removes any MOTW. [*]Turned OFF Microsoft Defender real-time protection, Cloud-delivered protection, and Automatic sample submission. [*]Executed files from the flash drive [B][COLOR=rgb(0, 168, 133)]- almost all were blocked (~ 95%).[/COLOR][/B] [*]Turned ON Microsoft Defender. [*]Restarted the computer. [*]Executed files again - [B][COLOR=rgb(0, 168, 133)]about 60% were allowed.[/COLOR][/B] [*]Turned OFF Microsoft Defender real-time protection, Cloud-delivered protection, and Automatic sample submission (like in point 2). [*]Restarted the computer. [*][COLOR=rgb(184, 49, 47)][B][B]Executed files again - about 60% were allowed, despite the fact that Microsoft Defender was disabled.[/B][/B][/COLOR] [/LIST] [B]Conclusion.[/B] If the file were successfully executed with ISG and Microsoft Defender, this is somehow remembered in the system (at least for some time). [/QUOTE]

Verification