Microsoft Defender AMSI False Positive — PowerShell Diagnostic Blocked as Trojan:PowerShell/AmsiBypazz.D!MTB

Generate and submit MpSupportFiles.cab, which is Microsoft’s documented evidence package for a fileless Defender detection when no original script file exists; restoring quarantined content is not required.^1^

Create the fileless-detection evidence package

Do this promptly on the affected computer so the package captures the currently available Defender records:

1. Open Command Prompt using Run as administrator.
2. Run:

(set "_done=" & if exist "%ProgramData%\Microsoft\Windows Defender\Platform\" (for /f "delims=" %d in ('dir "%ProgramData%\Microsoft\Windows Defender\Platform" /ad /b /o:-n 2^>nul') do if not defined _done (cd /d "%ProgramData%\Microsoft\Windows Defender\Platform\%d" & set _done=1)) else (cd /d "%ProgramFiles%\Windows Defender")) >nul 2>&1

MpCmdRun.exe -GetFiles

3. Wait several minutes. The expected output file is:

C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab

The package includes Microsoft Antimalware Service traces and events, relevant Defender registry data, update history, and Defender command-line logs.^2^

4. Submit the CAB through the Microsoft Security Intelligence submission portal, identify it as a false-positive/fileless detection, and include:
   • Detection name and threat ID
   • Detection ID
   • Exact date and local time
   • PowerShell version
   • Defender signature and engine versions
   • Existing submission ID
   • A plain-language description of the intended filesystem operations
   • The fact that the original content was an inline command and was never written to disk

Microsoft explicitly documents submission of MpSupportFiles.cab for behavior-based or fileless detections where there is no file to upload.^1^ Sign-in is required, and the submission history shows whether a case is submitted, in progress, or closed.^3^

A screenshot documents the alert but does not contain the scanned AMSI content. Add the CAB as a new submission and reference the earlier submission ID in its description.

What the detection ID and event records can provide

Defender event records can corroborate the detection, but the documentation does not say that a detection ID alone contains or reconstructs the original AMSI stream. Events 1015, 1116, and 1117 can record fields such as:

• Threat name and threat ID
• Path and process name
• Detection source and type
• Signature and engine versions
• Action taken
• AMSI as the source

Review them at:

1. Press Windows+R, enter eventvwr.msc, and select OK.
2. Open Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational.
3. Use Find or Filter Current Log around the detection time.
4. Export relevant events without clearing that log.^4^

Also inspect Applications and Services Logs → Microsoft → Windows → PowerShell → Operational. If Script Block Logging was already enabled, PowerShell may have recorded the processed command there. It cannot recover content retroactively if logging was not enabled at execution time.^5^

Do not publicly post the CAB or raw event exports; they can contain device and user information.

Repeat the diagnostic without disabling protection

PowerShell 7.3 and later sends script blocks and .NET method invocations to AMSI, so moving the same content from an inline command into a .ps1 file does not bypass scanning.^5^ It does, however, preserve an exact sample that can be submitted if Defender flags it again.

Use a new empty test directory, save a minimal script as a file, and avoid production data or broad permission changes:

$dir = Join-Path $env:TEMP 'FsDiagnostic'
New-Item $dir -ItemType Directory -Force | Out-Null
$file = Join-Path $dir 'zero-byte.test'

$stream = [IO.File]::Open($file, 'Create', 'Write', 'None')
try { $stream.Flush($true) }
finally { $stream.Dispose() }

$acl = Get-Acl -LiteralPath $file
Set-Acl -LiteralPath $file -AclObject $acl
[pscustomobject]@{
    Length = (Get-Item $file).Length
    CanReopen = [IO.File]::OpenRead($file).Dispose() -eq $null
    Owner = $acl.Owner
}

Flush($true) writes buffered data through intermediate file buffers to disk.^6^ Set-Acl writes the supplied security descriptor; this example reapplies the file’s existing descriptor rather than granting additional access.^7^

If Defender blocks this saved script:

• Leave the detection quarantined.
• Do not add an exclusion or select Allow on device.
• Submit the actual .ps1 as an incorrectly detected developer sample and reference the CAB submission.
• Wait for Microsoft’s final determination before running it again.

If the minimal script succeeds, add the original diagnostic operations back one at a time. This produces a small, reproducible sample identifying the exact statement or combination that triggers inspection while Defender and AMSI remain enabled.

References

1. Address false positives/negatives in Microsoft Defender for Endpoint
2. Collect Microsoft Defender Antivirus diagnostic data
3. Submit files for analysis
4. Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus
5. PowerShell security features
6. FileStream.Flush Method-Definition
7. Set-Acl-Description