learn.microsoft.com Open in urlscan Pro
2600:1415:9c00:393::3544 Public Scan

Back to summary

Submitted URL:
https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide
Effective URL:
https://learn.microsoft.com/en-nz/defender-xdr/submission-guide
Submission: On December 19 via api (December 19th 2024, 11:43:48 am UTC) from US — Scanned from NZ

Form analysis
3 forms found in the DOM

Name: site-header-search-form-mobile — GET /en-nz/search/

<form class="flex-grow-1" method="GET" role="search" id="ms--site-header-search-form-mobile" data-bi-name="site-header-search-form-mobile" name="site-header-search-form-mobile" aria-label="Search" action="/en-nz/search/">
  <div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
    <div class="field-body control ">
      <input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-header-search-autocomplete-input-mobile"
        data-test-id="site-header-search-autocomplete-input-mobile" class="autocomplete-input input 
						
						width-full" type="search" name="terms" aria-expanded="false" aria-owns="ax-3-listbox" aria-controls="ax-3-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-header-search-autocomplete-input-mobile-description"
        placeholder="Search" data-bi-name="site-header-search-autocomplete-input-mobile" pattern=".*">
      <span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
      <span hidden="" id="ms--site-header-search-autocomplete-input-mobile-description"> Suggestions will filter as you type </span>
    </div>
    <ul role="listbox" id="ax-3-listbox" data-test-id="site-header-search-autocomplete-input-mobile-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
    </ul>
    <!---->
  </div>
  <!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
  <button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
  <input name="category" hidden="" value="">
</form>

Name: site-header-search-form — GET /en-nz/search/

<form class="flex-grow-1" method="GET" role="search" id="ms--site-header-search-form" data-bi-name="site-header-search-form" name="site-header-search-form" aria-label="Search" action="/en-nz/search/">
  <div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
    <div class="field-body control ">
      <input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="site-header-search-autocomplete-input" data-test-id="site-header-search-autocomplete-input" class="autocomplete-input input input-sm
						
						width-full" type="search" name="terms" aria-expanded="false" aria-owns="ax-2-listbox" aria-controls="ax-2-listbox" aria-activedescendant="" aria-label="Search" aria-describedby="ms--site-header-search-autocomplete-input-description"
        placeholder="Search" data-bi-name="site-header-search-autocomplete-input" pattern=".*">
      <span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
      <span hidden="" id="ms--site-header-search-autocomplete-input-description"> Suggestions will filter as you type </span>
    </div>
    <ul role="listbox" id="ax-2-listbox" data-test-id="site-header-search-autocomplete-input-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
    </ul>
    <!---->
  </div>
  <!-- mobile safari will not dispatch submit event unless there's a submit button that is not display:none -->
  <button type="submit" class="visually-hidden" tabindex="-1" aria-hidden="true"></button>
  <input name="category" hidden="" value="">
</form>

javascript:

<form action="javascript:" role="search" aria-label="Search" class="margin-bottom-xxs"><label class="visually-hidden" for="ax-0">Search</label>
  <div class="autocomplete display-block" data-bi-name="autocomplete"><!---->
    <div class="field-body control has-icons-left">
      <input role="combobox" maxlength="100" aria-autocomplete="list" autocapitalize="off" autocomplete="off" autocorrect="off" spellcheck="false" id="ax-0" data-test-id="ax-0" class="autocomplete-input input input-sm
						control has-icons-left
						width-full" type="text" aria-expanded="false" aria-owns="ax-1-listbox" aria-controls="ax-1-listbox" aria-activedescendant="" aria-describedby="ms--ax-0-description" placeholder="Filter by title" pattern=".*">
      <span aria-hidden="true" class="icon is-small is-left">
        <span class="has-text-primary docon docon-filter-settings"></span>
      </span>
      <span aria-hidden="true" class="autocomplete-loader loader has-text-primary " hidden=""></span>
      <span hidden="" id="ms--ax-0-description"> Suggestions will filter as you type </span>
    </div>
    <ul role="listbox" id="ax-1-listbox" data-test-id="ax-0-listbox" class="autocomplete-suggestions is-vertically-scrollable padding-xxs " aria-label="Suggestions" hidden="">
    </ul>
    <!---->
  </div>
</form>

Text Content

Skip to main content



MICROSOFT LEARN CHALLENGE

Nov 23, 2024 – Jan 10, 2025

Build skills in the latest technologies and earn a digital badge by January 10!

Register now
Dismiss alert

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security
updates, and technical support.

Download Microsoft Edge More info about Internet Explorer and Microsoft Edge

Learn
Suggestions will filter as you type
Sign in


 * Profile
 * Settings

Sign out

Learn
   
 * Discover
      
    * Documentation
      
      In-depth articles on Microsoft developer tools and technologies
   
      
    * Training
      
      Personalized learning paths and courses
   
      
    * Credentials
      
      Globally recognized, industry-endorsed credentials
   
      
    * Q&A
      
      Technical questions and answers moderated by Microsoft
   
      
    * Code Samples
      
      Code sample library for Microsoft developer tools and technologies
   
      
    * Assessments
      
      Interactive, curated guidance and recommendations
   
      
    * Shows
      
      Thousands of hours of original programming from Microsoft experts
   
      
   
   Microsoft Learn for Organizations
   
   Boost your team's technical skills
   
   Access curated resources to upskill your team and close skills gaps.

   
 * Product documentation
      
    * ASP.NET
      
    * Azure
      
    * Dynamics 365
      
    * Microsoft 365
      
    * Microsoft Copilot
      
    * Microsoft Edge
      
    * Microsoft Entra
      
    * Microsoft Graph
      
    * Microsoft Intune
      
    * Microsoft Purview
      
    * Microsoft Teams
      
    * .NET
      
    * Power Apps
      
    * Power BI
      
    * Power Platform
      
    * PowerShell
      
    * SQL
      
    * Sysinternals
      
    * Visual Studio
      
    * Windows
      
    * Windows Server
      
   
   View all products
   
   Microsoft Learn for Organizations
   
   Boost your team's technical skills
   
   Access curated resources to upskill your team and close skills gaps.

   
 * Development languages
      
    * C++
      
    * C#
      
    * DAX
      
    * Java
      
    * OData
      
    * OpenAPI
      
    * Power Query M
      
    * VBA
      
   
   Microsoft Learn for Organizations
   
   Boost your team's technical skills
   
   Access curated resources to upskill your team and close skills gaps.

   
 * Topics
      
    * Artificial intelligence
      
    * Compliance
      
    * DevOps
      
    * Platform engineering
      
    * Security
      
   
   Microsoft Learn for Organizations
   
   Boost your team's technical skills
   
   Access curated resources to upskill your team and close skills gaps.

   

Suggestions will filter as you type
Sign in


 * Profile
 * Settings

Sign out
Microsoft Defender
   
 * Microsoft Defender products & services
     
   * Microsoft Defender XDR
     
   * Microsoft Defender for Endpoint
     
   * Microsoft Defender for Office 365
     
   * Microsoft Defender for Identity
     
   * Microsoft Defender Vulnerability Management
     
   * Microsoft Defender for Cloud Apps
     
   * Microsoft Defender for Business
     
   * Microsoft Defender for Cloud
     
   * Microsoft External Attack Surface Management
     
   * Microsoft Defender for IoT
     
   
 * Security resources
     
   * Microsoft security documentation
     
   * Microsoft Zero Trust guidance center
     
   * Microsoft Copilot for Security
     
   * Microsoft Defender training and certification
     
   
 * More
     
   * Microsoft Defender products & services
       
     * Microsoft Defender XDR
       
     * Microsoft Defender for Endpoint
       
     * Microsoft Defender for Office 365
       
     * Microsoft Defender for Identity
       
     * Microsoft Defender Vulnerability Management
       
     * Microsoft Defender for Cloud Apps
       
     * Microsoft Defender for Business
       
     * Microsoft Defender for Cloud
       
     * Microsoft External Attack Surface Management
       
     * Microsoft Defender for IoT
       
     
   * Security resources
       
     * Microsoft security documentation
       
     * Microsoft Zero Trust guidance center
       
     * Microsoft Copilot for Security
       
     * Microsoft Defender training and certification
       
     
   

Table of contents Exit focus mode

Search
Suggestions will filter as you type
 * Microsoft Defender XDR
 * Overview
 * Plan
 * Pilot and deploy Microsoft Defender XDR
 * Get started
 * Protect against threats
 * Investigate and respond to threats
 * Enhance security operations
 * Manage multitenant environments
 * Manage roles and permissions
 * Reference
 * Resources
   * Threat actor naming
   * Malware names
   * How Microsoft identifies malware and PUA
   * Submit files for analysis
   * Understand threat intelligence concepts
   * Microsoft virus initiative
   * Software developer FAQ
 * Microsoft Sentinel docs
 * Microsoft Defender XDR docs

Download PDF
    
 1. Learn
    
    
 2. Microsoft Defender
    
    
 3. Microsoft Defender XDR
    

    
 1. Learn
    
    
 2. Microsoft Defender
    
    
 3. Microsoft Defender XDR
    

Read in English Save
 * Add to Collections
 * Add to Plan

Table of contents Read in English Add to Collections Add to Plan Edit


--------------------------------------------------------------------------------

SHARE VIA

Facebook x.com LinkedIn Email

--------------------------------------------------------------------------------

Print
Table of contents


SUBMIT FILES FOR ANALYSIS

 * Article
 * 10/05/2024
 * 4 contributors

Feedback


IN THIS ARTICLE

    
 1. How do I submit a file to Microsoft for analysis?
    
 2. Can I send a sample by email?
    
 3. Can I submit a sample without signing in?
    
 4. What is the Software Assurance ID (SAID)?
    
 5. How do I track or view past sample submissions?
    
 6. What does the submission status mean?
    
 7. How does Microsoft prioritize submissions
    
 8. See also
    

Show 4 more

If you have a file that you suspect might be malware or is being incorrectly
detected, you can submit it to us for analysis. This page has answers to some
common questions about submitting a file for analysis.

Tip

If your organization's subscription includes Microsoft Defender for Endpoint
Plan 2, Microsoft Defender for Office 365 Plan 2, or Microsoft Defender XDR, you
can use the new unified submissions portal. To learn more, see Submit files in
Microsoft Defender for Endpoint.


HOW DO I SUBMIT A FILE TO MICROSOFT FOR ANALYSIS?

Important

Starting May 20, 2024, file submissions will be transitioning to a new Microsoft
Entra ID. If your tenant requires admin consent to continue accessing this
service, refer to Overview of user and admin consent and grant access to app ID:
6ba09155-cb24-475b-b24f-b4e28fc74365 with graph permissions for
Directory.Read.All and User.Read.


SEND A MALWARE FILE

You can send files that you think might be malware or files that were
incorrectly detected through the sample submission portal.

You can complete a quick analysis by providing detailed information about the
product you were using and what you were doing when you found the file.

After you sign in, you'll be able to track your submissions.

Note

You can use the Microsoft Security Intelligence submission feature even if you
don't have Microsoft Defender for Endpoint Plan 2 or Microsoft Defender for
Office Plan 2.


SUBMIT A SUSPECTED EMAIL ATTACHMENT

Use the Microsoft Defender portal to submit suspected email attachments to
Microsoft for review. For more information, see Submit a suspected email
attachment to Microsoft.


SUBMIT A FILE OR FILE HASH

Use the unified submissions feature in Microsoft Defender for Endpoint to submit
files and file hashes to Microsoft for review. For more information, see Submit
files in Microsoft Defender for Endpoint.


CAN I SEND A SAMPLE BY EMAIL?

No, we only accept submissions through our sample submission portal.


CAN I SUBMIT A SAMPLE WITHOUT SIGNING IN?

No. If you're an enterprise customer, you need to sign in so that we can
prioritize your submission appropriately. If you're currently experiencing a
virus outbreak or security-related incident, you should contact your designated
Microsoft support professional or go to Microsoft Support for immediate
assistance.


WHAT IS THE SOFTWARE ASSURANCE ID (SAID)?

The Software Assurance ID (SAID) is for enterprise customers to track support
entitlements. The submission portal accepts and retains SAID information and
allows customers with valid SAIDs to make higher priority submissions.


HOW DO I DISPUTE THE DETECTION OF MY PROGRAM?

Submit the file in question as a software developer. Wait until your submission
has a final determination.

If you're not satisfied with our determination of the submission, use the
developer contact form provided with the submission results to reach Microsoft.
We'll use the information you provide to investigate further if necessary.

We encourage all software vendors and developers to read about how Microsoft
identifies malware and unwanted software.


HOW DO I TRACK OR VIEW PAST SAMPLE SUBMISSIONS?

You can track your submissions through the submission history page.


WHAT DOES THE SUBMISSION STATUS MEAN?

Each submission is shown to be in one of the following status types:

 * Submitted—the file has been received

 * In progress—an analyst has started checking the file

 * Closed—a final determination has been given by an analyst

You can see the status of any files you submit to us on the submission history
page.


HOW DOES MICROSOFT PRIORITIZE SUBMISSIONS

Processing submissions take dedicated analyst resource. Because we regularly
receive a large number of submissions, we handle them based on a priority. The
following factors affect how we prioritize submissions:

 * Prevalent files with the potential to impact large numbers of computers are
   prioritized.

 * Authenticated customers, especially enterprise customers with valid Software
   Assurance IDs (SAIDs), are given priority.

 * Submissions flagged as high priority by SAID holders are given immediate
   attention.

Your submission is immediately scanned by our systems to give you the latest
determination even before an analyst starts handling your case. Note that the
same file may have already been processed by an analyst. To check for updates to
the determination, select rescan on the submission details page.


SEE ALSO

Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus





--------------------------------------------------------------------------------


FEEDBACK

Was this page helpful?

Yes No
Provide product feedback

--------------------------------------------------------------------------------


ADDITIONAL RESOURCES



--------------------------------------------------------------------------------

Training

Module

Enhance your email protection using Microsoft Defender for Office 365 - Training

This module examines how Microsoft Defender for Office 365 extends EOP
protection through various tools, including Safe Attachments, Safe Links,
spoofed intelligence, spam filtering policies, and the Tenant Allow/Block List.

Certification

Microsoft Certified: Security Operations Analyst Associate - Certifications

Investigate, search for, and mitigate threats using Microsoft Sentinel,
Microsoft Defender for Cloud, and Microsoft 365 Defender.



English (New Zealand)
California Consumer Privacy Act (CCPA) Opt-Out Icon Your Privacy Choices
Theme
 * Light
 * Dark
 * High contrast

 * 
 * Previous Versions
 * Blog
 * Contribute
 * Privacy
 * Terms of Use
 * Trademarks
 * © Microsoft 2024


ADDITIONAL RESOURCES



--------------------------------------------------------------------------------

Training

Module

Enhance your email protection using Microsoft Defender for Office 365 - Training

This module examines how Microsoft Defender for Office 365 extends EOP
protection through various tools, including Safe Attachments, Safe Links,
spoofed intelligence, spam filtering policies, and the Tenant Allow/Block List.

Certification

Microsoft Certified: Security Operations Analyst Associate - Certifications

Investigate, search for, and mitigate threats using Microsoft Sentinel,
Microsoft Defender for Cloud, and Microsoft 365 Defender.




IN THIS ARTICLE



English (New Zealand)
California Consumer Privacy Act (CCPA) Opt-Out Icon Your Privacy Choices
Theme
 * Light
 * Dark
 * High contrast

 * 
 * Previous Versions
 * Blog
 * Contribute
 * Privacy
 * Terms of Use
 * Trademarks
 * © Microsoft 2024