The dreaded App@SharePoint user name problem

This is still an issue albeit not in Delve.  SharePoint/OneDrive Malware alerts all list mailto:app@SharePoint as the user who uploaded the malware.  Our security team are not SharePoint admins and so cannot grant themselves access to the sites, to discover the actual user who uploaded the problem files.  So, just figuring out who uploaded malicious files is an all-hands-on-deck affair when it should not be.  Why can't I just see who uploaded a file, from the Defender portal?

I've created a (regular) ticket in Office 365, and this is the response I got:

The Account app@sharepoint is related to the SharePoint Applications (Auditing logs/Virus), it is a system account, belongs to the SharePoint Farms infrastructure, it was created to run on all Site Collections/Personal sites to collect auditing information. When the user provides some changes for his own Site Collection, or enables features or activates the site Auditing logs, his own account does not have the write permissions on the SharePoint Farm and this account it will be used to run and collect all the necessary information to be provided to the customer. Microsoft has set up a few security accounts to run in all Farms, in order for our customer to do some tasks, and get the required information. Also it is necessary for user security, for these accounts to always track the Site Collection searching for viruses that can be uploaded into SharePoint. Microsoft will not change that, all Farms have the same configuration and this same system account, and all Site Collections will use this account if they need to do it.

What Activities Should the customer expect from this account?
From the Customer side nothing will be expected, everything will be running normal, as should be, this account will not affect the Site Collection functionality or personal site, all the information on the Site Collection will be secure, and only the Site Owners and all people who have permissions to the site can see the information inside and share the same. This account can be visible if we create an auditing for our Site Collection or personal site. All private information is safe and, nothing will be collected, as we said before this account only gets information for auditing and looks for possible virus attack.

Not in the slightest a helpful response *sigh* :(

Adding nickrob for visability. 

The same problem at our site.. Started appearing in Desember

Regrads

Yngvar

Yeah, I already posted a message about this "problem". According to Mark-Kashman the team is aware of the issue and working on a fix