Microsoft Defender False Positive follow-up for Digitally Signed Application

Question

Hello, I am seeking a status update on a Microsoft Defender false-positive analysis submission. My application, developed by Computer Care, LLC was digitally signed using Azure Trusted Signing and submitted to Microsoft Defender for malware analysis. The signed executable continues to be detected as malicious by Microsoft Defender.

Actions already completed:

Obtained and configured Azure Trusted Signing.

Signed the executable successfully.

Verified the digital signature.

Submitted the signed executable for analysis

Replaced the previous unsigned version

Waited several days for the review process

I would appreciate a status update on the submission and confirmation whether any additional information is required from my side. If this forum is not the appropriate channel for Defender malware analysis inquiries, please advise how to contact the Microsoft Defender intelligence team regarding an existing submission.

Thank you,

Answer 1

Status updates for Microsoft Defender malware analysis submissions are not available through this forum. Status and any resulting definition changes are tracked through the Microsoft Security Intelligence submission site.

To check the status and provide any additional information:

1. Go to the Microsoft Security Intelligence submission site at https://www.microsoft.com/wdsi/filesubmission.
2. Sign in with the same account that was used to submit the file.
3. Review the submission history to see the current state and any feedback from Microsoft.

For digitally signed applications that are still being detected as malicious:

1. Ensure the file was submitted as a false positive, including clear justification and details about the publisher (Computer Care, LLC) and that it is signed using Azure Trusted Signing.
2. If the detection source is Microsoft Defender for Endpoint (EDR or Antivirus), follow the guidance to:
   • Submit the false positive to https://aka.ms/wdsi as documented in the Defender for Endpoint false positive guidance.
   • Optionally configure a temporary workaround such as an "allow" indicator or an antivirus exclusion, scoped only to the affected file, while waiting for Microsoft to update definitions.
3. If the file was detected in a SharePoint/OneDrive/Exchange scenario (for example via Safe Attachments or Defender for Endpoint signature detection), submit the file via the appropriate Submissions page in the Defender portal or via the Microsoft Security Intelligence portal, as described in the false-positive malware detection guidance.

If the file continues to be flagged after Microsoft confirms a false positive and updates definitions, contact Microsoft Support and specify that this is a recurring false positive for a digitally signed application.

This forum cannot directly access or modify Defender intelligence submissions; all interaction with the Defender intelligence team for existing submissions is done through the Microsoft Security Intelligence submission site and, if needed, via a support case.

---

References:

• Address false positives/negatives in Microsoft Defender for Endpoint
• Address false positives or false negatives in Microsoft Defender XDR
• Resolve false positive malware detections
• Troubleshoot problems with detecting and removing malware