Reply to thread

Message

<blockquote data-quote="LaurentG" data-source="post: 935988" data-attributes="member: 91050">Hi Andy,I just did the test, and I confirm it&#039;s OK now, at least for this script.To be very specific :- In the exact script you uploaded to Microsoft, MS Defender do not detect any more any threat (neither TrojanDownloader:HTML/Adodb.gen!A nor Trojan:VBS/Mountsi.A!ml.), and this without any exclusion / whitelisting defined.- In &quot;similar&quot; scripts obtained by slight modifications of the &quot;original&quot; script&nbsp; &nbsp; - MS Defender continue to detect TrojanDownloader:HTML/Adodb.gen!A, but, as it was already the case before, this detection can be bypassed with Folder (or file) exclusion.&nbsp; &nbsp; - MS Defender do not detect any more Trojan:VBS/Mountsi.A!ml. even if there is no exclusion definedThis means that fix provided by MS with the new security intelligence update version 1.333.1190.0. (and above) enhances AMSI-based detections and avoids (at least) THIS specific &quot;false positive&quot; detection.Nevertheless, the remaining question is : what would happen if AMSI-based threat was still detected ? And what will happen when such a detection will occur &quot;erroneously&quot; for a completely different script ? Will it be possible to &quot;exclude it&quot; for these scripts only ? Let me remind you that this was the initial issue I raised with this thread : Ability to exclude A GIVEN SCRIPT from AMSI-based detection without excluding ALL AMSI-based detection.And since these scripts are no more detected with AMSI-based detections, we still cannot answer definitely to this question.Nevethless, there is at least one question we&#039;ve been answered : It&#039;s now clear that you have very good relationship with Microsoft <img class="smilie smilie--emoji" loading="lazy" alt="😄" title="Grinning face with smiling eyes&nbsp; &nbsp; :smile:" src="https://cdn.jsdelivr.net/joypixels/assets/6.6/png/unicode/64/1f604.png" data-shortname=":smile:" /></blockquote>

[QUOTE="LaurentG, post: 935988, member: 91050"] Hi Andy, I just did the test, and I confirm it's OK now, at least for this script. To be very specific : - In the[B] exact script [/B]you uploaded to Microsoft, MS Defender do not detect any more any threat (neither TrojanDownloader:HTML/Adodb.gen!A nor Trojan:VBS/Mountsi.A!ml.), and this without any exclusion / whitelisting defined. - In "similar" scripts obtained by slight modifications of the "original" script - MS Defender continue to detect TrojanDownloader:HTML/Adodb.gen!A, but, as it was already the case before, this detection can be bypassed with Folder (or file) exclusion. - MS Defender [B]do not detect any more[/B] Trojan:VBS/Mountsi.A!ml. [B]even if there is no exclusion defined[/B] This means that fix provided by MS with the [I]new security intelligence update version 1.333.1190.0.[/I] (and above) enhances AMSI-based detections and avoids (at least) [B]THIS [/B]specific "false positive" detection. Nevertheless, the remaining question is : [B]what would happen if AMSI-based threat was still detected[/B] ? [B]And what will happen when such a detection will occur "erroneously" for a completely different script ?[/B] Will it be possible to "exclude it" for these scripts only ? Let me remind you that this was the initial issue I raised with this thread : [U][B]Ability to exclude A GIVEN SCRIPT from AMSI-based detection without excluding ALL AMSI-based detection.[/B][/U] And since these scripts are no more detected with AMSI-based detections, [U][B][U]we still cannot answer definitely to this question.[/U][/B][/U] Nevethless, there is at least one question we've been answered : [B]It's now clear that you have very good relationship with Microsoft 😄[/B] [/QUOTE]

Verification