Forum Discussion
Microsoft Defender AMSI false positive — private evidence submission guidance
We're seeking guidance on the official private review process for a suspected Microsoft Defender Antivirus AMSI false-positive detection.
Detection: HackTool:PowerShell/ApexToolkit.A
The detection occurred during an authorized PowerShell-based .NET development/testing workflow. The original AMSI payload is unavailable.
We've collected the official Microsoft Defender diagnostic CAB, but it contains personal and internal system information, along with unrelated security history.
Microsoft Support referred us to Tech Community because the consumer support channel could not escalate the investigation directly.
Our question: Is there an official private channel for submitting sanitized incident records for initial classification review, or obtaining guidance about secure handling of the full diagnostic CAB?
We want to maintain Defender protections and avoid posting sensitive diagnostic evidence publicly.
Thank you for any guidance on the appropriate Microsoft review process.
1 Reply
You need a private review route because the AMSI payload is unavailable and your diagnostic CAB contains sensitive information. An authorized development workflow alone cannot establish that this detection is a false positive.
Microsoft documents the Microsoft Security Intelligence submission portal for suspected false positives. For fileless or behavior-based detections without a sample, its Defender guidance specifically allows submitting MpSupportFiles.cab. Sign in so you can track the submission, identify the detection name, and explain that the original AMSI content is unavailable.
Keep the CAB off this public forum. If you cannot authorize uploading the complete package, ask your organization's Microsoft support contact for secure evidence-handling guidance before sending it; retain an unchanged original locally.
The documentation does not promise a classification from sanitized incident records alone. Explain what was removed from any copy and ask the reviewer what evidence is required. Keep Defender protections enabled while the classification remains unconfirmed.
