- Sep 6, 2019
- 122
Windows Defender Disappointment
- Thread starter Mercenary
- Start date
- Oct 1, 2019
- 1,120
Mark Of The Web, right mouse click any downloaded file and select properties
- Dec 23, 2014
- 8,510
The Windows built-in compression feature is OK (preserves MOTW), but it works only for ZIP files. So, many users install 3rd party archivers - most of them do not preserve MOTW.
Last edited:
- Dec 23, 2014
- 8,510
Downloads and the Mark-of-the-Web
Last update: October 4, 2024 Background To help protect the user and their device, Windows and its applications will often treat files originating from the Internet more cautiously than files gener…
textslashplain.com
Simply it is information added to the file downloaded from the Internet when using popular web browsers, OneDrive, and some other online services. MOTW can be added to the file only on the NTFS drive (so it is lost on most flash drives, and also on CD/DVD drives, CD/DVD images, Memory Cards). File downloaders, application auto-updates, malware, etc. usually download files without MOTW. Most archivers (but not Windows built-in and Bandizip) do not preserve MOTW.
Some security solutions like SmartScreen integrated with Explorer and CyberCapture feature in Avast, require MOTW to work properly. The documents with MOTW trigger the Protected View feature in MS Office and Adobe Acrobat Reader.
Adding the MOTW before file execution (like in Hard_Configurator and RunBySmartScreen) can force the SmartScreen check also for files stored on flash drives, CD/DVD drives, CD/DVD images, Memory Cards, etc.
Last edited:
- Aug 9, 2019
- 21
Today I received exactly the same letter as yesterday, only the sender is different, the name of the files is the same, but the hash the sum of the files is different)
The virus that arrived yesterday is already identified by 36 antivirus engines, a new file of 15 antiviruses. Although antiviruses detect it with the same name.
- Aug 9, 2019
- 21
- Jul 3, 2015
- 8,153
Your IT admin should not allow exe attachments to be received by email. That is leaving the door wide open to attacks. If it is a small business, and you are the admin, either switch to a more secure email provider, such as Outlook.com or Gmail, or figure out how to block suspicious file attachments with the service you have.
- Aug 9, 2019
- 21
Our mail is located on Gmail, we use G Suite and Gmail did not send them to spam. The virus was archived in .lzh format and it was not attached to the letter, there was a link to google drive.
- Jul 3, 2015
- 8,153
Ah, thanks for the update. That makes sense. Links will always be a problem. @Andy Ful's suggestion to use BandiZip is a good one. The more recent versions of Windows will be able to apply SmartScreen filtering to it, since the MarkOfTheWeb will still be present.
AV detection on email-delivered malware will always be hit-and-miss, because email tends to deliver zero-days. But SmartScreen is not easily fooled by zero-days. On the contrary, it is very suspicious of new samples, unless they bear a high-quality digital signature. That latter case is pretty rare, barring cases of high-level targeted attacks.
How about configuring the specific ASR rule "block executable content from email client and webmail?" According to MS Docs, exclusions can be made. Not sure if gmail would be included, though, as I don't have a virtual machine at the moment. Someone else know for sure? Regardless, I would not place 100% faith in just one mitigation, for anything.
Use attack surface reduction rules to prevent malware infection - Microsoft Defender for Endpoint
Attack surface reduction rules can help prevent exploits from using apps and scripts to infect devices with malware.
docs.microsoft.com
- Nov 26, 2016
- 699
You may call it delusional, I call it "have thrown enough ##### at it for years" to know it's not a delusion but real world experience with it. Basically ever since they introduced behavior PDM module and cloud system it's been basically bullet proof. Something I can't really say for any other antivirus. Maybe Comodo Internet Security, but it's plagued by so many problems, usability issues and stagnating development that I can't really recommend it to anyone coz of that. But these two are actually the only ones I'd trust them to such extent.
- Jul 3, 2015
- 8,153
Over the last few months, Kaspersky has not always been getting 100% in the commercial testing.
- Dec 23, 2014
- 8,510
This will work only for Outlook.How about configuring the specific ASR rule "block executable content from email client and webmail?" According to MS Docs, exclusions can be made. Not sure if gmail would be included, though, as I don't have a virtual machine at the moment. Someone else know for sure? Regardless, I would not place 100% faith in just one mitigation, for anything.
Use attack surface reduction rules to prevent malware infection - Microsoft Defender for Endpoint
Attack surface reduction rules can help prevent exploits from using apps and scripts to infect devices with malware.docs.microsoft.com
- Dec 23, 2014
- 8,510
If you meant WD (20%), then If I correctly recall most of the exploit methods were tested on Windows 7. Anyway, the WD free features protection (no ATP) in businesses, cannot be good because many computers in local networks are not connected to the Internet. So, the main WD free protection is useless because it highly depends on the cloud backend (Cloud delivered protection, BAFS, SmartScreen). The computers can be infected remotely from a single compromised machine connected to the local network.
"Kaspersky has not always been getting 100%"If you meant WD (20%), then If correctly recall most of the exploit methods were tested on Windows 7. Anyway, the WD free features protection (no ATP) in businesses, cannot be good because many computers in local networks are not connected to the Internet. So, the main WD free protection is useless because it highly depends on the cloud backend (Cloud delivered protection, BAFS, SmartScreen).
Which is fine as long as the percentage is high enough and there's some consistency among various testing organizations
defender is a minivan. if you want better performance you'll have to get a Ferrari
- Jul 3, 2015
- 8,153
I agree, I was just responding to @RejZoR's comment that Kaspersky gets it right every time. This may well be true in his personal testing, but the commercial testers didn't have exactly the same findings.
If people knew that MS is partnered with AV vendors, and those vendors contribute in some extent to WD, all this debate wont be so long lol.
Basically WD is indirectly powered by AV vendors using WD ATP in their infrastructure . Example Bit Defender.
Basically WD is indirectly powered by AV vendors using WD ATP in their infrastructure . Example Bit Defender.
- Mar 16, 2019
- 3,862
@Andy Ful But I've seen smartscreen.exe triggering even for files without MOTW. I use IDM and 7zip so MOTW is not present for anything I download but smartscreen does make dns queries after executing an exe files. How effective is this?
Similar threads
