Microsoft Defender AMSI false positive — private evidence submission guidance

We're seeking guidance on the official private review process for a suspected Microsoft Defender Antivirus AMSI false-positive detection.

Detection: HackTool:PowerShell/ApexToolkit.A

The detection occurred during an authorized PowerShell-based .NET development/testing workflow. The original AMSI payload is unavailable.

We've collected the official Microsoft Defender diagnostic CAB, but it contains personal and internal system information, along with unrelated security history.

Microsoft Support referred us to Tech Community because the consumer support channel could not escalate the investigation directly.

Our question: Is there an official private channel for submitting sanitized incident records for initial classification review, or obtaining guidance about secure handling of the full diagnostic CAB?

We want to maintain Defender protections and avoid posting sensitive diagnostic evidence publicly.

Thank you for any guidance on the appropriate Microsoft review process.