

It checks any files an app (including 3rd-party browsers and email clients) that attempts to download and run. Operating system integration: Microsoft Defender SmartScreen is integrated into the Windows 10 operating system.If there's no reputation, the item is marked as a higher risk and presents a warning to the user. If a URL, a file, an app, or a certificate has an established reputation, users don't see any warnings. It also provides reputation checks for apps, checking downloaded programs and the digital signature used to sign a file. Reputation-based URL and app protection: Microsoft Defender SmartScreen evaluates a website's URLs to determine if they're known to distribute or host unsafe content.For more information about drive-by attacks, see Evolving Microsoft Defender SmartScreen to protect you from drive-by attacks.

Because drive-by attacks can happen even if the user doesn't select or download anything on the page, the danger often goes unnoticed. Drive-by attacks are web-based attacks that tend to start on a trusted site, targeting security vulnerabilities in commonly used software. It can also help protect against deceptive advertisements, scam sites, and drive-by attacks.

Microsoft Defender SmartScreen determines whether a site is potentially malicious by: Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files.
