Why defender make différents diagnostics ?

Question

Hello,

recently i made some tests on a virtual machine and i copied some files from the vm to the host machine

at the begining there was no pb with defender on the host but now defender always detect "Trojan:Script/Wacatac.H!ml"

i would like to understand why ?

Has defender "learned" to detect some events using statistics on my host machine ? If yes, is it possible to reset defender on the host (to be like on the vm where there is no detection ?)

thanks

Answer 1

The TDT settings may be causing false-positive detections. But I'm not sure. And it's possible that TDT is unavailable on VMs.

I found the following image in a PDF file (sec002-enabling-intel-vpro.pdf).

See also:

Wacatac false positive outbreak? - Microsoft Community:

https://answers.microsoft.com/en-us/windows/forum/all/wacatac-false-positive-outbreak/0d92ef05-50db-4d12-92f4-fcfe8f0b966c

Answer 2

Thanks for reply

I compared and at the moment i found those differences :

On the host

TDTMode : rsw

TDTSiloType : E

TDTStatus : Enabled

TDTTelemetry : Disabled

---

ThreatIDDefaultAction_Actions : {6, 6, 6, 6...}

ThreatIDDefaultAction_Ids : {232718, 242420, 246173, 311936...}

On the vm

TDTMode : N/A

TDTSiloType : N/A

TDTStatus : N/A

TDTTelemetry : N/A

---

ThreatIDDefaultAction_Actions :

ThreatIDDefaultAction_Ids :

Answer 3

Hi Marc,

The following PowerShell commands show the Microsoft Defender Antivirus configuration, the security intelligence and the platform versions.

• get-mpcomputerstatus
• get-mppreference

You may run these two commands on the host as well as the VM, and compare the two outputs.