[Bug]: Defender falsely marks scripts including text "privacy.sexy" as malicious

[undergroundwires]

Description

Defender team added word "privacy.sexy" as virus signature...
I'm surprised by this.

Pasting scripts in command line gives this:

This script contains malicious content and has been blocked by your antivirus software.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : ScriptContainedMaliciousContent

Or leads to Defender alert: Trojan:PowerShell\MpTamperPShell.HF severe threat.

If I change the word privacy.sexy to "not sexy" it works without issues.

Script outputs "Hello world" with word privacy.sexy in it (leads to malware alert):

PowerShell -ExecutionPolicy Unrestricted -Command "$command = 'echo Hello world'; $trustedInstallerSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'); $trustedInstallerName = $trustedInstallerSid.Translate([System.Security.Principal.NTAccount]); $streamOutFile = New-TemporaryFile; $batchFile = New-TemporaryFile; try { $batchFile = Rename-Item $batchFile "^""$($batchFile.BaseName).bat"^"" -PassThru; "^""@echo off`r`n$command`r`nexit 0"^"" | Out-File $batchFile -Encoding ASCII; $taskName = 'privacy.sexy invoke'; schtasks.exe /delete /tn "^""$taskName"^"" /f 2>&1 | Out-Null <# Clean if something went wrong before, suppress any output #>; $taskAction = New-ScheduledTaskAction -Execute 'cmd.exe' -Argument "^""cmd /c `"^""$batchFile`"^"" > $streamOutFile 2>&1"^""; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName $taskName -Action $taskAction -Settings $settings -Force -ErrorAction Stop | Out-Null; try { ($scheduleService = New-Object -ComObject Schedule.Service).Connect(); $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $trustedInstallerName) | Out-Null; $timeOutLimit = (Get-Date).AddMinutes(5); Write-Host "^""Running as $trustedInstallerName"^""; while((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 200; if((Get-Date) -gt $timeOutLimit) { Write-Warning "^""Skipping results, it took so long to execute script."^""; break; }; }; if (($result = (Get-ScheduledTaskInfo $taskName).LastTaskResult) -ne 0) { Write-Error "^""Failed to execute with exit code: $result."^""; }; } finally { schtasks.exe /delete /tn "^""$taskName"^"" /f | Out-Null <# Outputs only errors #>; }; Get-Content $streamOutFile; } finally { Remove-Item $streamOutFile, $batchFile; }"

Script outputs "Hello world" with word not sexy in it (does not lead to any alert):

PowerShell -ExecutionPolicy Unrestricted -Command "$command = 'echo Hello world'; $trustedInstallerSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'); $trustedInstallerName = $trustedInstallerSid.Translate([System.Security.Principal.NTAccount]); $streamOutFile = New-TemporaryFile; $batchFile = New-TemporaryFile; try { $batchFile = Rename-Item $batchFile "^""$($batchFile.BaseName).bat"^"" -PassThru; "^""@echo off`r`n$command`r`nexit 0"^"" | Out-File $batchFile -Encoding ASCII; $taskName = 'not sexy invoke'; schtasks.exe /delete /tn "^""$taskName"^"" /f 2>&1 | Out-Null <# Clean if something went wrong before, suppress any output #>; $taskAction = New-ScheduledTaskAction -Execute 'cmd.exe' -Argument "^""cmd /c `"^""$batchFile`"^"" > $streamOutFile 2>&1"^""; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName $taskName -Action $taskAction -Settings $settings -Force -ErrorAction Stop | Out-Null; try { ($scheduleService = New-Object -ComObject Schedule.Service).Connect(); $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $trustedInstallerName) | Out-Null; $timeOutLimit = (Get-Date).AddMinutes(5); Write-Host "^""Running as $trustedInstallerName"^""; while((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 200; if((Get-Date) -gt $timeOutLimit) { Write-Warning "^""Skipping results, it took so long to execute script."^""; break; }; }; if (($result = (Get-ScheduledTaskInfo $taskName).LastTaskResult) -ne 0) { Write-Error "^""Failed to execute with exit code: $result."^""; }; } finally { schtasks.exe /delete /tn "^""$taskName"^"" /f | Out-Null <# Outputs only errors #>; }; Get-Content $streamOutFile; } finally { Remove-Item $streamOutFile, $batchFile; }"

I'm not sure how to solve this.
Should I just remove the name privacy.sexy? Why play a cat-mouse game?
I do not want to try to evade antivirus detection, but going for the name of privacy.sexy to mark something as suspicious is very poor way to handle things for a security softwa<re.

How can the bug be recreated?

Paste the scripts in the description in terminal or create bat file with it.

Operating system

Windows 11 Pro 23H2

Script file

Affecting scripts with privacy.sexy word in it.

Screenshots

Terminal error:

Defender warning:

Additional information

See #296 (comment) as official privacy.sexy response to Defender alerts.

Defender version

```txt PS C:\Users\undergroundwires> Get-MpComputerStatus

AMEngineVersion : 1.1.24070.3
AMProductVersion : 4.18.2201.11
AMRunningMode : Normal
AMServiceEnabled : True
AMServiceVersion : 4.18.2201.11
AntispywareEnabled : True
AntispywareSignatureAge : 0
AntispywareSignatureLastUpdated : 8/27/2024 3:44:08 AM
AntispywareSignatureVersion : 1.417.340.0
AntivirusEnabled : True
AntivirusSignatureAge : 0
AntivirusSignatureLastUpdated : 8/27/2024 3:44:07 AM
AntivirusSignatureVersion : 1.417.340.0
BehaviorMonitorEnabled : True
ComputerID : 1C277694-7969-40B5-A1CD-9066EB56DE4F
ComputerState : 0
DeviceControlDefaultEnforcement : N/A
DeviceControlPoliciesLastUpdated : 8/27/2024 7:16:28 AM
DeviceControlState : N/A
FullScanAge : 4294967295
FullScanEndTime :
FullScanStartTime :
IoavProtectionEnabled : True
IsTamperProtected : True
IsVirtualMachine : True
LastFullScanSource : 0
LastQuickScanSource : 0
NISEnabled : True
NISEngineVersion : 1.1.24070.3
NISSignatureAge : 0
NISSignatureLastUpdated : 8/27/2024 3:44:07 AM
NISSignatureVersion : 1.417.340.0
OnAccessProtectionEnabled : True
QuickScanAge : 4294967295
QuickScanEndTime :
QuickScanStartTime :
RealTimeProtectionEnabled : True
RealTimeScanDirection : 0
TamperProtectionSource : Signatures
TDTMode : N/A
TDTStatus : N/A
TDTTelemetry : N/A
PSComputerName :

</details>

[plantindesk]

Try checking this
Only Microsoft Defender

[plantindesk]

I tried to simplify the code and got no false positives.

$commandToExecute = 'echo Hello world'

$trustedInstallerSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464')
$trustedInstallerName = $trustedInstallerSid.Translate([System.Security.Principal.NTAccount])

$tempBatchFile = New-TemporaryFile
$tempOutputFile = New-TemporaryFile

try {

    $tempBatchFile = Rename-Item $tempBatchFile -NewName "$($tempBatchFile.BaseName).bat" -PassThru

    "@echo off
    $commandToExecute
    exit 0" | Out-File $tempBatchFile -Encoding ASCII

    $taskName = 'privacy.sexy'

    schtasks.exe /delete /tn "$taskName" /f 2>&1 | Out-Null

    $taskAction = New-ScheduledTaskAction -Execute 'cmd.exe' -Argument "cmd /c ""$tempBatchFile"" > $tempOutputFile 2>&1"

    $taskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries

    Register-ScheduledTask -TaskName $taskName -Action $taskAction -Settings $taskSettings -Force -ErrorAction Stop | Out-Null

    try {

        $scheduleService = New-Object -ComObject Schedule.Service
        $scheduleService.Connect()

        $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $trustedInstallerName) | Out-Null

        $timeOutLimit = (Get-Date).AddMinutes(5)

        Write-Host "Running as $trustedInstallerName"
        while ((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) {
            Start-Sleep -Milliseconds 200
            if ((Get-Date) -gt $timeOutLimit) {
                Write-Warning "Skipping results, it took too long to execute the script."
                break
            }
        }

        $taskResult = (Get-ScheduledTaskInfo $taskName).LastTaskResult
        if ($taskResult -ne 0) {
            Write-Error "Failed to execute with exit code: $taskResult"
        }
    } finally {

        schtasks.exe /delete /tn "$taskName" /f 
    }

    Get-Content $tempOutputFile
} finally {

    Remove-Item $tempOutputFile, $tempBatchFile
}

Virustotal

I think you saw this (Just Saying)
https://www.youtube.com/watch?v=ehTIhQpj9ys

[plantindesk]

Also, There’s no need to be surprised by this. AME Wizard, also known as Ameliorated Wizard, is a tool for modifying Windows. We can configure AME Wizard using Playbooks, a modular extension format that uses simple YAML instructions. Verifying your Playbook can help us establish a trusted user base.

Windows Security might automatically flag AME Wizard Beta as malicious when attempting to run it, or even delete it before it has a chance to execute, as soon as it is saved to the filesystem. If you encounter this issue, follow the steps outlined in this guide to bypass these problems and use the Wizard within minutes.
Preventing AME Wizard Beta from Being Deleted
In some cases, Windows Security might flag the executable immediately, even before running it. To address this, you can add an exclusion from the Windows Security settings pane. This manual rule will prevent the Wizard from being deleted.

Altering System = FP in Windows Defender

Reference:

Atlas OS (Another optimized Windows modification)