We all know that no AV is perfect. MSE does use heuristics and other things that are not visible to the user. When it finds something suspicious, it checks the AV servers for new definitions that have not been released in a package yet and if there are any, it applies those. According to MS, it looks through databases of all it's security systems in that process. MSE, Smart Screen, Defender, and the MRT might even be used to remove anything detected. It actually is not a bad product at all but I had problems with it and I prefer Avast. MSE is heavier on resources and much slower in scanning speed.