Microsoft Defender AMSI false positive — private evidence submission guidance

You need a private review route because the AMSI payload is unavailable and your diagnostic CAB contains sensitive information. An authorized development workflow alone cannot establish that this detection is a false positive.

Microsoft documents the Microsoft Security Intelligence submission portal for suspected false positives. For fileless or behavior-based detections without a sample, its Defender guidance specifically allows submitting MpSupportFiles.cab. Sign in so you can track the submission, identify the detection name, and explain that the original AMSI content is unavailable.

Keep the CAB off this public forum. If you cannot authorize uploading the complete package, ask your organization's Microsoft support contact for secure evidence-handling guidance before sending it; retain an unchanged original locally.

The documentation does not promise a classification from sanitized incident records alone. Explain what was removed from any copy and ask the reviewer what evidence is required. Keep Defender protections enabled while the classification remains unconfirmed.