Windows Defender Detection rate

The AV-Comparatives Real-World Protection Test uses a state-of-the-art testing methodology – so it’s great to see that Windows Defender has finally reached the 100% detection mark in that test:

http://chart.av-comparatives.org/chart1.php?chart=chart2&year=2018&month=2&sort=0&zoom=2

But it’s important to keep in mind that this methodology tests all of the AV apps with their default settings, and that we can add significantly more protection to the mix by enabling Windows Defender’s new “next-gen” features:

Block at First Sight (Seen):

Windows Defender can now immediately block a suspicious or unknown file; upload a sample for analysis; and generate a signature – all within a matter of seconds. And we can use PowerShell to upgrade the default level of protection for this feature. The upgrade settings aren’t documented, but I tricked PowerShell into revealing their named values by specifying a numerical value that I knew was out of range:

To configure a higher level of cloud protection (Cloud Block Level), run one of these commands at the Administrator PowerShell prompt:

Set-MpPreference -CloudBlockLevel High

Set-MpPreference -CloudBlockLevel HighPlus

Set-MpPreference -CloudBlockLevel ZeroTolerance

And you can also increase the allotted file-analysis time by running this command at the Administrator PowerShell prompt:

Set-MpPreference -CloudExtendedTimeout 50

Windows Defender Exploit Guard:

The exploit protection features that were previously provided by EMET are now integrated into Windows 10; and most users shouldn’t need to modify the default settings for these.

Attack Surface Reduction:

We also have the ability to add Attack Surface Reduction rules in Version 1709, but the only practical way to add these rules in Windows 10 Home is with the PowerShell Set-MpPreference cmdlet:

For example, here’s the first rule that I set up by running a command line at the Administrator PowerShell prompt:

Rule: Block JavaScript or VBScript from launching downloaded executable content:

Set-MpPreference -AttackSurfaceReductionRules_Ids D3E037E1-3EB8-44C8-A917-57927947596D -AttackSurfaceReductionRules_Actions Enabled

Then to add additional rules, we use the Add-MpPreference command:

Rule: Block executable content from email client and webmail:

Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Enabled

https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction

Controlled Folder Access:

Controlled Folder Access is turned off by default; so you’ll need to turn it on in the Windows Defender Security Center app > Virus & threat protection > Virus & threat protection settings. Once Controlled Folder Access is turned on, standard Windows document folders will be protected by default, and you’ll also be able to add ransomware protection for additional folders, as well as whitelist trusted applications in order to allow them access to your protected folders. If you have trouble whitelisting a friendly app, then you can set this feature to run in Audit Mode, where it will identify access events, but won’t block them. Run this command at the Administrator PowerShell prompt to set Audit Mode:

Set-MpPreference -EnableControlledFolderAccess AuditMode

There’s already a lot of confusion about allowing an app through Controlled Folder Access, and some “Windows experts” are responding to this with a just-turn-it-off “solution” – but if you just jot down the blocked app’s file path that appears in the notification; and then click on the notification, this will bring up the “Allow an app through Controlled folder access” window, where you can quickly add the blocked app to the default whitelist:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_updating-windows_10/unauthorized-change-blocked/0939daa3-b556-4494-a478-b151854e1a93

PUA Protection:

Windows Defender has actually been able to detect and block Potentially Unwanted Applications for some time now, but many people still don’t know that this feature is disabled by default and needs to be enabled by running this command line at the Administrator PowerShell prompt:

Set-MpPreference -PUAProtection 1

The AMTSO Feature Settings Check for Desktop Solutions has a test for PUA Protection: 

https://www.amtso.org/feature-settings-check-for-desktop-solutions/

And we have a more extensive set of feature checks available at the Windows Defender Antivirus Testground:

https://demo.wd.microsoft.com/?ocid=cx-wddocs-testground

This thread explains how AV vendors often use the AV-testing lab data selectively in order to paint a deceptive picture of their product’s effectiveness:

https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning-windows_10/what-is-the-best-antivirus-malware-spyware-program/a3ef7acc-848e-47a7-ae72-39511a35ac78

GreginMich

AV Comparatives.Real-World Protection Tests February 2018

https://www.av-comparatives.org/dynamic-tests/

http://chart.av-comparatives.org/chart1.php

AV-Test

https://www.av-test.org/en/news/news-single-view/the-best-security-packages-for-windows-10/

Stopping ransomware where it counts: Protecting your data with Controlled folder access

https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/stopping-ransomware-where-it-counts-protecting-your-data-with-controlled-folder-access/

How to Protect Your Files From Ransomware With Windows Defender’s New “Controlled Folder Access”

https://www.howtogeek.com/329532/how-to-protect-your-files-from-ransomware-with-windows-defenders-controlled-folder-access/

~bhringer