Tutorial: The fastest way to report a False negative in Defender for Endpoint!

Intro

Encountering a false negative during a customer engagement can be a critical issue. Recently, I faced a similar situation where a particular exploit went undetected. While I won’t delve into the specifics of the exploit, I want to highlight an efficient method to report false negatives promptly for resolution.

In my recent experience, the false negative case was addressed within just 4 days of thorough investigations.

During my writing (25/12) , Microsoft updated their docs about “how to address Address false positives/negatives in Microsoft Defender for Endpoint” (12/01). I suggest to also read it. You can find it here , it covers more use case then my blog.

Evidence

My advise is before you submit your case, get as much evidence you can provide. Here is a list I put into my case:

• Described the steps that would allow Microsoft to reproduce the issue internally
• A document backed with screenshots of the process and devices involved incl. Device ID where the activity was observed, the org ID , the exact date/time of the event (in UTC preferably) , the event details and observed telemetry (device timeline)
• Clarified what was the vulnerability that was exploited and that was not alerted incl. CVE Reference.
• Reproduced the issue with the lasted version of MDATP and confirmed if the alert is triggered in the MDE portal
• Collected logs from the device that was exploited:
  • For linux use the XMDEClientAnalyzer http://aka.ms/XMDEClientAnalyzer 
  • For Windows use the MDATPanalyzer https://aka.ms/mdatpanalyzer

Submission

There are a couple public submission methods:

• Microsoft Security Intelligence
• MSRC Researcher Portal
• Support Case in costumer tenant

The first two didn’t fit into my category, its more if you want to report malicious files, URL’s or security research. So what I did was, I created a support case in the costumers tenant:

1. Go to https://security.microsoft.com/
2. On the right op click on ‘Help’

3. Choose a contact method and preferred settings

4. Fill in the additional required fields and upload the evidence you created earlier. It’s important to put the following line in your title: “EDR False Negative (FN) Detection.”

5. click on ‘Contact me’

That is! Now the waiting game can start and i hope you get your False negative resolved as soon as possible !