Address unwanted behaviors in Microsoft Defender for Endpoint

Microsoft Defender for Endpoint helps prevent and detect malicious processes and files. It protects your organization from threats while keeping productivity intact. Sometimes, unwanted behaviors can occur, such as:

False positives: A file or process is flagged as malicious even though it isn't a threat
Poor performance: Apps run slower when certain Defender for Endpoint features are active
Application incompatibility: Apps don't work correctly when certain Defender for Endpoint features are active

This article explains how to address these unwanted behaviors and includes example scenarios.

Note

Creating an indicator or an exclusion should only be considered after thoroughly understanding the root cause of the unexpected behavior.

General process for addressing unwanted behaviors

At a high level, the process for addressing an unwanted behavior in Defender for Endpoint is as follows:

Identify which capability is causing the unwanted behavior. To make your determination, determine if there's a misconfiguration with Microsoft Defender Antivirus, endpoint detection and response, attack surface reduction (ASR) rules, or controlled folder access (CFA). Use information in the Microsoft Defender portal or on the device.

Location	What to do
The Microsoft Defender portal	To help identify what's happening, take one or more of the following actions: - Investigate alerts - Use advanced hunting - View reports
On the device	To identify the issue, take one or more of the following steps: - Use performance analyzer tools - Review event logs and error codes - Check your protection history

Depending on your findings from the previous step, you might take one or more of the following actions:
Tamper protection affects whether exclusions can be modified or added. See What happens when tamper protection is turned on.
Verify that your changes addressed the issue.

Examples of unwanted behaviors

The following example scenarios show cases that can be addressed by using exclusions and indicators. For more information about exclusions, see Exclusions overview.

An app is detected by Microsoft Defender Antivirus when the application runs

In this scenario, whenever a user runs a certain application, the application is detected by Microsoft Defender Antivirus as a potential threat.

How to address: Create an "allow" indicator for Microsoft Defender for Endpoint. For example, you can create an "allow" indicator for a file, such as an executable. See Create indicators for files.

A custom, self-signed app is detected by Microsoft Defender Antivirus when the application runs

In this scenario, Microsoft Defender Antivirus detects a custom app as a potential threat. The app is updated periodically and is self-signed.

How to address: Create "allow" indicators for certificates or files. See the following articles:

A custom app accesses a set of file types that is detected as malicious when the application runs

In this scenario, a custom app accesses a set of file types, and the set is detected as malicious by Microsoft Defender Antivirus whenever the application runs.

How to observe: When the application is running, behavior monitoring in Microsoft Defender Antivirus detects it.

How to address: Define exclusions for Microsoft Defender Antivirus, such as a file or path exclusion that might include wildcards. Or define a custom file path exclusion. See the following articles:

An application is detected by Microsoft Defender Antivirus as a "behavior" detection

In this scenario, Microsoft Defender Antivirus detects an application because of certain behavior, even though the application isn't a threat.

How to address: Define a process exclusion. See the following articles:

An app is considered a potentially unwanted application (PUA)

In this scenario, an app is detected as PUA, and you want to allow it to run.

How to address: Define an exclusion for the app. See the following articles:

An app is blocked from writing to a protected folder

In this scenario, a legitimate app is blocked from writing to folders that are protected by controlled folder access.

How to address: Add the app to the "allowed" list for controlled folder access. See Allow apps to modify files in protected folders.

A third-party app is detected as malicious by Microsoft Defender Antivirus

In this scenario, a third-party app that isn't a threat is detected and identified as malicious by Microsoft Defender Antivirus.

How to address: Submit the app to Microsoft for analysis. See How to submit a file to Microsoft for analysis.

An app is incorrectly detected and identified as malicious by Defender for Endpoint

In this scenario, a legitimate app is detected and identified as malicious by an attack surface reduction (ASR) rule in Microsoft Defender Antivirus. The ASR rule Block JavaScript or VBScript from launching downloaded executable content blocks any downloaded content when the user tries to use the app.

For the available methods to see ASR rule detections in Defender for Endpoint, see Monitor attack surface reduction (ASR) rule activity.

How to address:

Use the Attack surface reduction rules report to see the detections, affected devices, and affected files. In particular, you can download the full file and path information for the affected files to exclude from the ASR rule on the Add exclusions tab of the report.

For the available methods to configure ASR rule exclusions, see File and folder exclusions for ASR rules.

Word templates that contain macros that launch other apps are blocked

In this scenario, the ASR rule Block Win32 API calls from Office macros blocks Microsoft Word when a user opens documents created from Microsoft Word templates that contain macros, and those macros launch other applications.