Address unwanted behaviors in Microsoft Defender for Endpoint

Microsoft Defender for Endpoint helps prevent and detect malicious processes and files. It protects your organization from threats while keeping productivity intact. Sometimes, unwanted behaviors can occur, such as:

False positives: A file or process is flagged as malicious even though it isn't a threat
Poor performance: Apps run slower when certain Defender for Endpoint features are active
Application incompatibility: Apps don't work correctly when certain Defender for Endpoint features are active

This article explains how to address these unwanted behaviors and includes example scenarios.

Note

Create an indicator or an exclusion only after thoroughly understanding the root cause of the unexpected behavior.

General process for addressing unwanted behaviors

At a high level, the process for addressing an unwanted behavior in Defender for Endpoint is as follows:

Identify which capability is causing the unwanted behavior. Determine if there's a misconfiguration with Microsoft Defender Antivirus, endpoint detection and response, attack surface reduction (ASR) rules, or controlled folder access (CFA). Use information in the Microsoft Defender portal or on the device.

Location	What to do
The Microsoft Defender portal	To help identify what's happening, take one or more of the following actions: - Investigate alerts - Use advanced hunting - View reports
On the device	To identify the issue, take one or more of the following steps: - Use performance analyzer tools - Review event logs and error codes - Check your protection history

Depending on your findings about which capability is causing the unwanted behavior, take one or more of the following actions:
Tamper protection affects whether you can modify or add exclusions. See What happens when tamper protection is turned on.
Verify that your changes addressed the issue.

Examples of unwanted behaviors

The following example scenarios show cases that can be addressed by using exclusions and indicators. For more information about exclusions, see Exclusions overview.

An app is detected by Microsoft Defender Antivirus when the application runs

In this scenario, whenever a user runs a certain application, Defender Antivirus detects the application as a potential threat.

How to address: Create an allow indicator for Microsoft Defender for Endpoint. For example, you can create an allow indicator for a file, such as an executable. See Create indicators for files.

A custom, self-signed app is detected by Microsoft Defender Antivirus when the application runs

In this scenario, Microsoft Defender Antivirus detects a custom app as a potential threat. The app is updated periodically and is self-signed.

How to address: Create allow indicators for certificates or files. See the following articles:

A custom app accesses a set of file types that is detected as malicious when the application runs

In this scenario, a custom app accesses a set of file types, and Defender Antivirus detects the set as malicious whenever the application runs.

How to observe: When the application is running, behavior monitoring in Microsoft Defender Antivirus detects it.

How to address: Define exclusions for Microsoft Defender Antivirus, such as a file or path exclusion that might include wildcards. Or define a custom file path exclusion. See the following articles:

An application is detected by Microsoft Defender Antivirus as a "behavior" detection

In this scenario, Microsoft Defender Antivirus detects an application because of certain behavior, even though the application isn't a threat.

How to address: Define a process exclusion. See the following articles:

An app is considered a potentially unwanted application

In this scenario, an app is detected as a potentially unwanted application (PUA), and you want to allow it to run.

How to address: Define an exclusion for the app. See the following articles:

An app is blocked from writing to a protected folder

In this scenario, a legitimate app is blocked from writing to folders that are protected by controlled folder access.

How to address: Add the app to the allowed list for controlled folder access. See Allow apps to modify files in protected folders.

A third-party app is detected as malicious by Microsoft Defender Antivirus

In this scenario, Defender Antivirus detects a third-party app that isn't a threat as malicious.

How to address: Submit the app to Microsoft for analysis. See How do I submit a file to Microsoft for analysis?

An app is incorrectly detected and identified as malicious by Defender for Endpoint

In this scenario, an attack surface reduction (ASR) rule in Defender Antivirus detects a legitimate app as malicious. The ASR rule Block JavaScript or VBScript from launching downloaded executable content blocks any downloaded content when the user tries to use the app.

To learn how to view ASR rule detections in Defender for Endpoint, see Monitor attack surface reduction (ASR) rule activity.

How to address: Use the Attack surface reduction rules report to see the detections, affected devices, and affected files. You can download the full file and path information for the affected files to exclude from the ASR rule on the Add exclusions tab of the report.

To learn how to configure ASR rule exclusions, see File and folder exclusions for ASR rules.

Word templates that contain macros that launch other apps are blocked

In this scenario, the ASR rule Block Win32 API calls from Office macros blocks Microsoft Word when a user opens documents created from Microsoft Word templates that contain macros, and those macros launch other applications.