M.D.A. Was Not Detecting Dangerous Downloads?

Yes. It can happen that a dangerous download is not blocked or warned on immediately, depending on how the file was downloaded and how it was classified.

Microsoft Edge does not treat every file the same way:

• NOT_DANGEROUS files can download freely.
• DANGEROUS files should always warn.
• ALLOW_ON_USER_GESTURE files are potentially dangerous and are allowed automatically only when both of these are true:
  1. The download started with a user gesture, such as clicking a link.
  2. There was a recorded prior visit to the referring site before the most recent midnight.

Edge also allows these downloads automatically if the download was started with Save link as, the URL was entered directly in the address bar, or Microsoft Defender SmartScreen indicates the file is safe.

To improve detection and review what happened:

1. In Windows, open Start > Settings > Update & Security > Windows Security > Virus & threat protection.
2. Under Virus & threat protection settings, select Manage settings.
3. Make sure Cloud-delivered protection and Automatic sample submission are turned On.
4. Back in Virus & threat protection, under Virus & threat protection updates, select Check for updates.
5. If a suspicious file was quarantined, open Threat history and then See full history under Quarantined threats to review it.
6. If the same threat keeps returning, run Windows Defender Offline scan from Virus & threat protection > Scan options > Windows Defender Offline scan. Note: this restarts the PC.
7. If a suspicious file was not detected, submit the file to Microsoft for analysis.

If the file was downloaded but not opened, Windows may still mark it as coming from the internet. To check:

1. Open File Explorer.
2. Right-click the file and select Properties.
3. On the General tab, look for a security message.
4. Only use Unblock if the file is from a trusted source.

In Edge, SmartScreen can also be checked here:

1. Open Microsoft Edge.
2. Select Settings and more (...) > Settings.
3. Select Privacy, search, and services.
4. Under Security, verify Microsoft Defender SmartScreen is turned on.

Turning off SmartScreen can make the device more vulnerable to malicious files and websites.

References:

• Identify and interrupt downloads of potentially dangerous files
• Antivirus and antimalware software: FAQ
• Troubleshoot problems with detecting and removing malware
• Information about the Attachment Manager in Microsoft Windows