Reply to thread

Message

<blockquote data-quote="Local Host" data-source="post: 938711">[USER=72227]@Raiden[/USER] I disagree, [USER=32260]@Andy Ful[/USER] has multiple times denied Windows Defender has weaknesses against script attacks (went as far as claiming WD competes against Kaspersky on this department), same way he claims there&#039;s no need for third parties AVs nowadays.Using AV tests to prove a point is simply a weak argument (those tests are to be taken as a grain of salt, and not real world results), something that can be easily tested on your own environment, write a simple malicious script and WD won&#039;t flitch after analysing the code from AMSI (try the same with any other third-party AV, this was actually done recently on a topic I already shared here).Despite WD having improved over the years, is still not a top tier product and will let a good chunk of malware pass through it, on the Enterprise with ATP is a different story, as long as it is being monitored by a professional.As for UAC bypasses, Microsoft own APIs supply the doors, I use them often at work, so my scripts don&#039;t bother casual users with prompts while being able to run code with elevated privileges (making the processes entirely automatic).[USER=62850]@danb[/USER] is true SRP has been deprecated, Microsoft wants people to use Application Control and AppLocker instead.</blockquote>

[QUOTE="Local Host, post: 938711"] [USER=72227]@Raiden[/USER] I disagree, [USER=32260]@Andy Ful[/USER] has multiple times denied Windows Defender has weaknesses against script attacks (went as far as claiming WD competes against Kaspersky on this department), same way he claims there's no need for third parties AVs nowadays. Using AV tests to prove a point is simply a weak argument (those tests are to be taken as a grain of salt, and not real world results), something that can be easily tested on your own environment, write a simple malicious script and WD won't flitch after analysing the code from AMSI (try the same with any other third-party AV, this was actually done recently on a topic I already shared here). Despite WD having improved over the years, is still not a top tier product and will let a good chunk of malware pass through it, on the Enterprise with ATP is a different story, as long as it is being monitored by a professional. As for UAC bypasses, Microsoft own APIs supply the doors, I use them often at work, so my scripts don't bother casual users with prompts while being able to run code with elevated privileges (making the processes entirely automatic). [USER=62850]@danb[/USER] is true SRP has been deprecated, Microsoft wants people to use Application Control and AppLocker instead. [/QUOTE]

Verification