Shield Profile DIfferences

[gmariani405]

I remember a while back finding some documentation on what the actual differences are between each of the shield profiles. Does anyone know where to find that? It showed which techniques were employed for which profile to help make a decision on which profile to use. 

 

I noticed they recently added an MS Office profile and was curious how that differed from Other. Thanks!

[pbust]

Welcome to the forum and thanks for posting.

 

Yes I think there was some old post about this. But I can't find it myself.

 

The basic guidance when adding custom shields where the profile is not clear is to start with the browser profile and then fall back to either the Office/PDF profile or, as a last option, the Other profile. The reason for falling back to Office/PDF or Other is only in the case of having conflicts with the Browser profile.

 

PS: Moving this thread to the Questions sub-forum.

[gmariani405]

I found what I was looking for, it is in the program itself for those wondering as well.

 

Settings->Advanced Settings

 

See below:

 

 

 

[gmariani405]

Hmm.. now maybe a question for Malwarebytes employees, can someone explain why you would want to disable certain features for a specific profile? For example, why wouldn't I want to have DEP Bypass protection enabled on the Other profile? Thanks!

[pbust]

The answer is because of potential conflicts. The Advanced settings are there to be able to finetune the Profiles in the case of conflicts with third party applications. We ship the exploit mitigation techniques already finetuned for these Profiles, striking the best possible balance between security and compatibility. These default settings protect against the exploits ITW and then some. But Advanced settings allows users to finetune them a bit more by turning on/off certain mitigations in the case of conflicts. Not all the exploit mitigation techniques can be found in the Advanced settings, only the ones we expose to be configured by users.

 

You can turn on all the exploit mitigations on your system to see if it throws any false positives or conflicts. If it doesn't, then good. But if it does throw problems, you can always scale back one by one or simply click the "Restore defaults" button.