About The Home Microsoft Defender Test Ground Website?

Question

I entered one of your websites to test whether or not my installed M.D.A. is working?.I entered the title Cloud-Delivered Protection and pressed the download button in blue without getting the end warning results as shown on the screen images?.I even did a custom, and quick ,and full scan, and nothing was detected?.The downloaded file is called MDECloudProtectionDemoTest?, and should i be concerned after the M.D.A. is totally okay with it?.I even copied and pasted a name for the Powershell and then installed NuGet? by pressing Y ?,that made no difference?..Should i send the downloaded file to Microsoft for a second opinion scan or should i just ignore it?

Answer 1

The MDECloudProtectionDemoTest file from the Cloud-Delivered Protection demo is a safe, fake malware sample provided by Microsoft specifically to test Microsoft Defender Antivirus cloud protection. It is not real malware.

When cloud-delivered protection and required connectivity are working, Microsoft Defender Antivirus should detect and block that sample when it is downloaded. The expected behavior is:

1. A warning notification from Microsoft Defender Antivirus that the file was detected and blocked.
2. If using Microsoft Edge or Internet Explorer, an additional browser notification.
3. An entry in Windows Security → Virus & threat protection → Protection history under Quarantined threats.

If the file downloaded and no detection occurred, that indicates the cloud-delivered protection path is not behaving as expected, not that the file itself is dangerous. The file is intentionally harmless and designed only to verify protection.

Actions to take:

1. Verify cloud-delivered protection and sample submission are turned on:
   • Start → Settings → Update & Security → Windows Security → Virus & threat protection → Manage settings.
   • Ensure Cloud-delivered protection and Automatic sample submission are On.
2. Validate Defender cloud connectivity:
   • Open an elevated PowerShell or Command Prompt.
   • Run:

          cd "C:\Program Files\Windows Defender"
          MpCmdRun.exe -ValidateMapsConnection
     

   • This checks that Defender can reach the cloud protection service.
3. Confirm Defender platform and intelligence are current:
   • In an elevated PowerShell:

          Get-MPComputerStatus | Format-Table AMProductVersion, AntivirusSignatureVersion, AMEngineVersion
     

   • Compare against the latest versions listed in the Microsoft Update Catalog and Microsoft Security Intelligence pages referenced in the context.
4. Re-test the demo after confirming the above. If it still is not detected but all settings and connectivity are correct, treat it as a false negative scenario.
5. For a false negative, submit the file to Microsoft for analysis using the official submission channels referenced in the documentation. This is optional for this particular demo file (because it is known safe), but it is the correct process if Defender is not detecting test or real samples as expected.

There is no need to be concerned about the MDECloudProtectionDemoTest file itself; it is a Microsoft-provided fake sample and is not harmful. Focus on verifying and correcting Defender cloud protection configuration and connectivity rather than worrying about that file.

---

References:

• Configure and validate Microsoft Defender Antivirus network connections
• Troubleshoot problems with detecting and removing malware
• Evaluate Microsoft Defender Antivirus using Microsoft Defender Endpoint Security Settings Management (Endpoint security policies)
• Cloud protection and sample submission at Microsoft Defender Antivirus
• Protect your PC from unwanted software