Issue We have two methods of detection: Based on file-extension only (based-on-never-seen-before-file-extension is true) Based on [file-extension + high-entropy] (based-on-never-seen-before-file-exten...Issue We have two methods of detection: Based on file-extension only (based-on-never-seen-before-file-extension is true) Based on [file-extension + high-entropy] (based-on-never-seen-before-file-extension is false) So, it is decided to disable the file-extension-only-based detection by default (based-on-never-seen-before-file-extension will be false by default). For a workload that doesn't generate too many file-extensions, the customer can explicitly enable it.