Defender AntiVirus Safe Sample submission

Question

Hi everyone,

with Defender AntiVirus Cloud Protection Service (formally MAPS or Spynet) you can submit samples to MS for in-dept malware-analysis.

The article https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission?view=o365-worldwide says: "Safe samples are samples considered to not commonly contain PII data like: .bat, .scr, .dll, .exe."

According to my own test, html files are transmitted to Microsoft as safe samples as well. So is there a list of all file endings consideres as safe samples?

Thanks,
Nils

Answer 1

Hi @Nils

As the safe samples are sent automatically requested by the Defender for Endpoint antivirus cloud protection the most matching format is .html . Only when it fails we might Manual File Sample Collection by Security Admin from Defender for Endpoint Management Portal and you would use a script to do it so .reg might also be a safe sample format.

Hope this Answers all your queries , if not please do repost back .
If an Answer is helpful, please click "Accept Answer" and upvote it : )