Windows Defender Detects Trojan

[kevinelwell]

OS: Windows 11 Pro Version 25H2 (OS Build 26200.7840)
Running the sysmon-builder.exe as non-privileged user

This looks like a very useful tool, and I would like to use it. However, after Windows Defender detected a trojan, I have reservations.

After unzipping and executing the sysmon-builder.exe, I received a prompt immediately from Windows Defender that a trojan was detected: Trojan:Win32/Bearfoos.B!ml. Defender then quarantined the sysmon-builder.exe.

VirusTotal scan of sysmon-builder-windows.zip came back clean, as did the Windows Defender scan of sysmon-builder-windows.zip file.

Scanning sysmon-builder.exe with VirusTotal did show some detections.

[Infinit3i]

It might be saying that because of the powershell scripts that are ran to query to system to get a better baseline

[Infinit3i]

I will look into it and get back to you.