Driver submission rejected at Sign stage with BlockingDetectionFound (4001) - Submission ID 1152921505700974059

Question

Driver submission rejected at Sign stage with BlockingDetectionFound (4001) - Submission ID 1152921505700974059

orangelabs 0

Hello Microsoft Hardware team and community,

Our driver submission has been rejected at the Sign stage of the Hardware Dashboard pipeline with a non-retryable "BlockingDetectionFound" error. I am unable to file a formal support incident due to multiple access issues described below, so I am posting here in hopes that a Microsoft moderator can route this to the Hardware Dashboard operations team.

Submission Details

Submission ID: 1152921505700974059
Submission Name: ofilter 0.3.1.9(8) - Initial
Product Name: ofilter 0.3.1.9(8)
Submission Type: Initial
Driver Type: File system minifilter driver, x64
Signing Certificate: Valid EV code signing certificate
Partner Center Account: ******@rootorangelabs.onmicrosoft.com
Tenant ID: 5138e9dd-d46e-4403-b2bb-a5728e22023c

Workflow Status

All prior stages passed successfully:

Package Acceptance: Passed
Preparation: Passed
Scanning: Passed
Validation: Passed ("INF validation successful", "Drivers passed Universal check successfully")
Catalog creation: Passed
Sign: FAILED
Finalize: Not reached

Error Returned by Sign Stage


{

  "code": "FileSigningFailed",

  "details": {

    "error": "FailDoNotRetry returned from Scan service. 4001 [errorInfo, BlockingDetectionFound]"

  },

  "innerError": null

}

Independent Verification (Evidence of False Positive)

We scanned the same orange.sys binary that was packaged in the submission against two independent sources:

Microsoft Defender (local, latest definitions): MpCmdRun.exe -Scan -ScanType 3 -File ...\orange.sys Result: "Scan finished. Scanning ...\orange.sys found no threats."
VirusTotal (multi-engine scan): Result: Clean. No engines flagged the file.

Both sources confirm the binary is not malicious. We believe the Scan service in the Partner Center signing pipeline is using a heuristic that is producing a false positive against legitimate file-system minifilter behaviors.

Product Description

Kernel-mode file system minifilter driver targeting Windows 10 / Windows 11 x64
Used for endpoint performance/security telemetry (file I/O monitoring via PreCreate, PostCreate, PreSetInformation)
Built with the latest WDK, /utf-8 enabled, full SAL annotations, passes PREfast and Code Analysis
Passes Driver Verifier (Standard + Pool Tracking) without issues
Pre-signed with valid EV certificate before submission

Why I Cannot File a Formal Support Incident

I have attempted multiple paths and all have failed:

The Hardware workspace is not available in my Partner Center support form (Workspace dropdown does not include Hardware), even though Hardware Dashboard itself is fully accessible and the submission is visible there.
The Enrollment workspace is also not visible in the support form.
Direct access to the Windows Developer Support page (developer.microsoft.com/en-us/windows/support) returns AADSTS90072 - my home tenant user ******@rootorangelabs.onmicrosoft.com cannot access the WdcProd application (client_id e424126d-844b-4912-bf69-8988e844eb78).
The Partner Center AI Assistant repeatedly returns generic Marketplace/account-verification documentation links and does not surface a path to a human support engineer for my account context, even when explicitly asked to escalate.

Request

Could a Microsoft moderator please help with one of the following:

Route this case directly to the Hardware Dashboard / signing service operations team for manual review of submission 1152921505700974059, OR
Provide a working path for me to file a formal support incident from a tenant that has the access issues described above.

We also need:

Confirmation of whether BlockingDetectionFound 4001 is a false positive in this case
The specific file name / SHA-256 hash within the package that triggered the block, and the detection signature name if possible
Guidance on whether the existing submission can be reprocessed, or whether we should resubmit with a higher version number

This is currently blocking the release of our product to customers. Any guidance from the team or community would be greatly appreciated.

Thank you.

Contact: ******@orangesys.co.kr (preferred reply address)

0 comments

1 answer

Your answer

Answer 1

BlockingDetectionFound (4001) is raised by the signing pipeline’s scan service when a blocking security detection is found on one or more files in the submission. This is treated as a non‑retryable error in the Hardware Dashboard pipeline and prevents the Sign stage from completing.

The available context does not provide:

The specific file or hash that triggered BlockingDetectionFound
The exact detection signature name
Any documented way to override or reprocess a submission that has hit this specific 4001 condition

From the provided documentation, the only supported path to get file‑ or driver‑specific security detections reviewed or corrected is through the Microsoft Security Intelligence submission channels:

Submit the driver binary for security analysis
- Use the Microsoft Security Intelligence Driver Submission page referenced in the “Microsoft recommended driver block rules” documentation to submit the driver for analysis. This is the documented path for drivers that may have been flagged as vulnerable or malicious.
- For general file/driver false positives, sign in to the Microsoft Security Intelligence submission site and submit the file as a suspected false positive. Enterprise customers with valid Software Assurance IDs can mark submissions as high priority and receive higher priority handling.
Monitor and follow up on the submission
- After submitting, sign in periodically to the Microsoft Security Intelligence submission site to check status updates on the analysis.
- If the file is confirmed clean and a detection is removed or updated, a subsequent driver submission using the same binary should no longer hit the same blocking detection.
Resubmit the driver package after detection is cleared
- Once Microsoft Security Intelligence confirms the detection has been adjusted, create a new hardware submission in the Partner Center hardware dashboard with the same or a higher driver version, as appropriate for the product’s versioning policy.
- The standard hardware submission process (package creation, validation, signing) will then re‑run with the updated detection state.

If the issue persists even after Security Intelligence confirms the file is clean, the next step is to contact Partner Center dashboard technical support from a tenant that can access the Hardware workspace. The context only documents this path for metadata/device‑stage issues, but it is the documented escalation route when a submission is blocked by a Dashboard error.

References: