Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 935421" data-attributes="member: 32260">Understand. Yes, such exclusion can decrease the scripting detection if it was done for the dangerous script, especially when used in the wild. That is why I suggested you rather split the script to avoid detection. But, as you concluded by yourself you do not think that this particular script is dangerous and it was not used in the wild (it is your own script). I submitted this script to Microsoft and the analyst also thinks so.If you do not believe the Microsoft analyst and think that your script can be dangerous anyway, then do not exclude it.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />Edit.It is probable that the cumulative effect of excluding many different scripts could make an impact on post-execution script detection. To avoid this, one should try to submit all excluded scripts to Microsoft. After submitting, they are often used to learn Defender models to improve the detection (minimize the false-positive rate without decreasing malware detection).</blockquote>

[QUOTE="Andy Ful, post: 935421, member: 32260"] Understand. Yes, such exclusion can decrease the scripting detection if it was done for the dangerous script, especially when used in the wild. That is why I suggested you rather split the script to avoid detection. But, as you concluded by yourself you do not think that this particular script is dangerous and it was not used in the wild (it is your own script). I submitted this script to Microsoft and the analyst also thinks so. If you do not believe the Microsoft analyst and think that your script can be dangerous anyway, then do not exclude it.(y) Edit. It is probable that the cumulative effect of excluding many different scripts could make an impact on post-execution script detection. To avoid this, one should try to submit all excluded scripts to Microsoft. After submitting, they are often used to learn Defender models to improve the detection (minimize the false-positive rate without decreasing malware detection). [/QUOTE]

Verification