[antsar]

> But the question is, from an adversary perspective, does your victim have it disabled?

Does it even matter? Extrapolating from that quote: a submitted sample could make abusive network requests against the victim (from MSFT's network, which is "trusted"), as well as network requests back to the attacker's server for control and/or data collection.