Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 935120" data-attributes="member: 32260">Because, the AMSI-paired ML still blocks the script I resubmitted it to Microsoft and asked to remove the Trojan:VBS/Mountsi.A!ml (AMSI-paired ML) detection. After several hours this detection was removed, but the script is now blocked by Trojan:O97M/Mountsi.D! (another AMSI-paired ML detection).Anyway, some interesting conclusions can be made:<ol>
<li data-xf-list-type="ol">Submitting the script to Microsoft can rather quickly remove the Defender antimalware detection. The same can be done locally by excluding the script via Security Center.</li>
<li data-xf-list-type="ol">The procedure from point 1 cannot automatically remove the detections made by AMSI-paired ML and ASR rules.</li>
<li data-xf-list-type="ol">In some cases removing one of AMSI-paired ML detections does not remove other AMSI-paired ML detections.</li>
<li data-xf-list-type="ol">ASR exclusions do not remove non-ASR detections.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 935120, member: 32260"] Because, the AMSI-paired ML still blocks the script I resubmitted it to Microsoft and asked to remove the Trojan:VBS/Mountsi.A!ml (AMSI-paired ML) detection. After several hours this detection was removed, but the script is now blocked by Trojan:O97M/Mountsi.D! (another AMSI-paired ML detection). Anyway, some interesting conclusions can be made: [LIST=1] [*]Submitting the script to Microsoft can rather quickly remove the Defender antimalware detection. The same can be done locally by excluding the script via Security Center. [*]The procedure from point 1 cannot automatically remove the detections made by AMSI-paired ML and ASR rules. [*]In some cases removing one of AMSI-paired ML detections does not remove other AMSI-paired ML detections. [*]ASR exclusions do not remove non-ASR detections. [/LIST] [/QUOTE]

Verification