autounattend.xml blocked as Trojan:XML/GreatXML.DA!MTB by Defender

[andrewdbond]

I'm a long-time user — thanks for your work!

Today a freshly generated default autounattend.xml, and an existing autounattend.xml I generated on April 2, are being blocked by Windows Defender as Trojan:XML/GreatXML.DA!MTB.

This may relate to the "GreatXML" BitLocker bypass PoC (https://github.com/MSNightmare/GreatXML) uploaded yesterday by @MSNightmare

The unattend.xml in that repo has the schneegans.de generator URL in the XML.

I didn't see any existing mentions of this in this repo's issues/discussions.

I don't know if there's a way to (or if it'd be worth) changing the generated XML to try to cause Defender not to block it, or if multiple people should try submitting a false-positive report to Microsoft via https://www.microsoft.com/en-us/wdsi/filesubmission ? I have submitted it there as a false positive as a user.

[acolwill]

It's because it spawns a system level command shell to process the pre boot stuff. Which is what Defender is picking up on.

Instead of fixing their poorly written software, they're breaking automation!

I found this out the hard way after my WDS server stopped working this morning!

[cschneegans]

I am not sure what exactly is triggering Windows Defender. It will also detect the “GreatXML” trojan in this autounattend.xml file, which does not have any commands in the PE stage.

[cschneegans]

I have submitted it there as a false positive as a user.

FWIW, I have also submitted a report to Microsoft Security Intelligence.

[cschneegans]

It appears that Windows Defender does no longer flag autounattend.xml files – at least, this is what happens with the file I had uploaded previously.