Windows Defender detects Trojan:Script/Wacatac.B!ml

[akiirui]

The Windows Defender detects the "Trojan:Script/Wacatac.B!ml" when I compiling a hello_world project.

Environments:

• Windows 10 21H1
• Windows Defender Security intelligence version: 1.347.319.0
• Rust: stable-x86_64-pc-windows-gnu rustc 1.54.0 (a178d03 2021-07-26)

Steps to reproduce:

1. open cmd.exe
2. cd %USERPROFILE%\Downloads
3. create a main.rs with a simple function main (such as println!("hello world"))
4. rustc .\main.rs
5. .\main.exe
6. Windows Defender warning

Windows Defender detects rustc compiling output as "Trojan:Script/Wacatac.B!ml" in User's Downloads folder only.

And if you copy compiled executable file to Downloads folder from another place, It will also detected as "Trojan:Script/Wacatac.B!ml".

[wesleywiser]

Just as another data point, I tried this but wasn't quite able to repro. After invoking main.exe, I got a popup which said Windows Defender was scanning the file and then it ran normally.

Running the file again after that shows neither the popup nor a delay before execution.

• Windows 10 21H1
• Windows Defender Security intelligence version: 1.347.319.0
• Rust 1.54 stable

[guilhermewerner]

This has happened to me a few times too, and after a second check windows defender didn't alert anymore.

However I would like to get more information on why this happens.

[akiirui]

@wesleywiser Emm, It's still happened to me everytime.

It's cause by Windows Defender "Cloud security scan".

Disable "Cloud-delivered protection" in Defender can stop it, but it's not the best solution.

It seems that Microsoft Cloud Virus Database marks the output of rust compilation as "Trojan:Script/Wacatac.B!ml".

[nagisa]

The most appropriate course of action here is to submit your file to Microsoft as they are vendor of the antivirus solution you're using.

[akiirui]

The most appropriate course of action here is to submit your file to Microsoft as they are vendor of the antivirus solution you're using.

Ok, I will do this, Thanks.