{"id":16248,"date":"2026-05-04T02:00:52","date_gmt":"2026-05-03T17:00:52","guid":{"rendered":"https:\/\/m365jp.net\/?p=16248"},"modified":"2026-05-04T02:02:15","modified_gmt":"2026-05-03T17:02:15","slug":"servicedegradation-dz1299600-microsoft-defender-xdr-some-users-may-receive-false-positive-alerts-from-microsoft-defender-antivirus-for-specific-certificates","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2026-05-04-servicedegradation-dz1299600-microsoft-defender-xdr-some-users-may-receive-false-positive-alerts-from-microsoft-defender-antivirus-for-specific-certificates","title":{"rendered":"[serviceDegradation] DZ1299600 | Microsoft Defender XDR | Some users may receive false positive alerts from Microsoft Defender Antivirus for specific certificates"},"content":{"rendered":"
\n
\n
\n\n\n\n
DZ1299600 | Microsoft Defender XDR | Some users may receive false positive alerts from Microsoft Defender Antivirus for specific certificates<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n\n\n
Status<\/th>\nserviceDegradation<\/td>\n<\/tr>\n
Classification<\/th>\nincident<\/td>\n<\/tr>\n
User Impact<\/th>\nUsers may receive false positive alerts from Defender Antivirus and see legitimate files or certificates quarantined.<\/td>\n<\/tr>\n
Last Updated<\/th>\n05\/03\/2026 16:51:37<\/td>\n<\/tr>\n
Start Time<\/th>\n05\/03\/2026 16:11:06<\/td>\n<\/tr>\n
End Time<\/th>\n<\/td>\n<\/tr>\n
Latest Message<\/th>\nTitle: Some users may receive false positive alerts from Microsoft Defender Antivirus for specific certificates <\/p>\n

User impact: Users may receive false positive alerts from Defender Antivirus and see legitimate files or certificates quarantined. <\/p>\n

More info: Users may have received an alert in Microsoft Defender Antivirus notifying them of the following alert:
“‘Cerdigent’ high-severity malware was detected
Malware: Trojan:Win32\/Cerdigent.A!dha”<\/p>\n

Affected users should update to Security Intelligence Version 1.449.430.0 or a later version to remediate impact. <\/p>\n

Current status: We’ve received reports from a subset of affected tenants utilizing Microsoft Defender Antivirus who may be receiving alerts notifying them of a false positive detection in Defender Antivirus, which reads as, “ThreatName – Trojan:Win32\/Cerdigent.A!dha.” We’ve isolated that the threat was a detection logic issue in a recent Security Intelligence update which caused legitimate files or certificates to be incorrectly identified as \u201cTrojan:Win32\/Cerdigent.A!dha.\u201d We’ve created and implemented new false positive suppression rules to prevent users from being impacted by these alerts, and we’ve also published a new version of Microsoft Defender Antivirus Security Intelligence (Version 1.449.430.0) containing a hotfix to remediate the alerts, which we urge users to upgrade to at this time. Simultaneously, we’re working to restore files and certificates that were incorrectly quarantined due to the alerts, and we aim to provide a timeline to remediation as soon as one becomes available. <\/p>\n

Scope of impact: Some users may receive alerts in Microsoft Defender for Antivirus notifying them of false positive alerts for specific certificates. This section may be updated as the investigation progresses. <\/p>\n

Start time: Sunday, May 03, 2026, at 9:14 AM UTC <\/p>\n

Root cause: A detection logic issue in a recent Security Intelligence update caused legitimate files or certificates to be incorrectly identified as \u201cTrojan:Win32\/Cerdigent.A!dha.\u201d <\/p>\n

Next update by: Sunday, May 03, 2026, at 6:00 PM UTC<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

DZ1299600 | Microsoft Defender XDR | Some users may receive false positive alerts from Microsoft Defender Anti […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16248","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/16248","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/comments?post=16248"}],"version-history":[{"count":0,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/16248\/revisions"}],"wp:attachment":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/media?parent=16248"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/categories?post=16248"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/tags?post=16248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}