General AV question regarding MS Defender for Endpoint

Doing a proof of concept on MS defender for endpoint. It's been deployed to a limited scope of systems as an alternate AV package. Weekly I have to research various files stuck in quarantine that are of various virus detections such as Wacatac and Phonzy. So far, after roughy a dozen detections, I have proven that they are false positives. This is based on using a sheep dip machine and processing the files with multiple AV packages such as Sophos Intercept with XDR and Malware Bytes. My question is, has anyone else had a similar experience with MS Defender? I can't imagine the amount of time I'll be putting in to researching false positives based on the PoC.

AV Detections are tough - it all depends on the who the company is to be perfectly honest. Some use some pretty wide ML models to detect and diagnose which can mean a shotty TP:FP ratio.

• What are the exact detection names you saw? Often these companies have naming heuristics which might point to whether or not its a broad detection and, thus, FP prone.
• What file types were being detected specifically? Sometimes file types are filled with sufficient entropy that they're statistically more likely to hit a yara rule just right to trigger a detection
• Are there any functionality ties consistent across the affected machines? This might either further explain FPs or give you insight as to an infection vector if they are actually TP and being missed by other AV prods.

Edited by SwimminThruGrey, 12 November 2024 - 01:13 PM.