Request for AMSI Detection Review — Trojan:PowerShell/AmsiBypazz.D!MTB

Submit the existing MpSupportFiles.cab as a fileless detection through the Microsoft Security Intelligence submission portal, reference the earlier submission ID in the notes, and wait for the analyst’s final determination before rerunning the diagnostic.

Submit the AMSI detection for review

Microsoft explicitly supports submitting MpSupportFiles.cab when Defender detects malware behavior but no file exists to submit—the situation described here. ^1^

1. Open the Microsoft Security Intelligence submission portal.
2. Sign in. Authentication is required and lets you track the submission.
3. Submit the existing MpSupportFiles.cab:
   • Product: Microsoft Defender Antivirus/Defender for Endpoint, as applicable.
   • Classification: Incorrectly detected or Clean (false positive).
   • Identify it as a fileless AMSI/PowerShell detection.
4. In the notes, include:
   • Threat name and threat ID.
   • Detection ID.
   • Detection date and approximate local time/time zone.
   • PowerShell version and Windows version.
   • A concise description of the intended filesystem and ACL operations.
   • Previous submission ID [GUID].
   • The fact that the previous submission contained only a screenshot.
   • The fact that no exclusion, restoration, AMSI bypass, or Defender disablement occurred.
5. Retain the new submission number and monitor its status in the portal.

Submissions cannot be sent by email. The portal statuses are Submitted, In progress, and Closed; Closed means an analyst has issued a final determination. If the determination is unsatisfactory, use the developer contact form presented with the result. ^2^

Value of the existing CAB

The CAB is the correct and useful artifact for this case. MpCmdRun.exe -GetFiles collects Defender events, Antimalware Service traces, relevant configuration, update history, and Defender command logs. ^3^

Relevant contents include:

• MPOperationalEvents.txt — Defender Antivirus operational events.
• MPRegistry.txt — Defender configuration at collection time.
• MPLog.txt — detailed Defender actions and operations. ^4^

Because the package has already been generated, do not replace it unless Microsoft asks for a newer package or a reproduction-time trace. Preserve the original CAB unchanged. If Support separately requests transfer, place it only in the submission portal or a secure location to which the assigned Microsoft support team has access, such as a password-protected OneDrive folder. ^3^

Submitting replacement script content

If a minimal replacement script can be saved without executing it, submit that .ps1 separately through the same portal as Clean (false positive) and cross-reference both submission IDs. The portal supports file and file-hash submissions; hashes alone are less useful when Microsoft needs to analyze the actual script content. ^5^

Do not reconstruct or modify the original script and describe it as the original sample. Label any new artifact clearly as a minimal reproduction derived from the blocked diagnostic and document exactly what differs.

If Defender prevents the replacement from being saved, do not add an exclusion or restore quarantined content merely to obtain the sample. Keep the CAB submission as the primary review artifact and ask the analyst whether source text can be supplied through the submission’s follow-up channel.

Safe retesting and required disposition

Do not retry the blocked diagnostic merely because the detection now shows Inactive. That status records the present threat state; it is not an analyst determination that the script is safe.

Retry only after one of these outcomes:

• The submission is Closed with a clean/false-positive determination and any stated protection update has been applied.
• Microsoft provides case-specific written instructions for a controlled reproduction.
• Your organization’s authorized security team independently approves a controlled test environment and procedure.

Before an approved retry, update Defender security intelligence and retain real-time protection, behavior monitoring, and script scanning. These are prerequisites for supported AMSI operation. ^6^

Avoid exclusions unless Microsoft or the responsible security administrator explicitly authorizes a narrowly scoped, temporary mitigation. Microsoft recommends defining antivirus exclusions sparingly and reviewing them regularly. ^1^

No public documentation can pre-authorize this particular script. The required written disposition is the final result attached to the Security Intelligence submission or explicit instructions from the Microsoft support case handling the CAB.

References

1. Address false positives/negatives in Microsoft Defender for Endpoint
2. Submit files for analysis
3. Collect Microsoft Defender Antivirus diagnostic data
4. Troubleshoot attack surface reduction (ASR) rules
5. Submit files in Microsoft Defender for Endpoint
6. AMSI demonstrations with Microsoft Defender for Endpoint