Skip to content

Windows Defender Detection #6

@jamesonknutson

Description

@jamesonknutson

Hi, not sure if this is the right place for this. I was just getting Navi set up on my Windows 10 Machine, starting by downloading some of the featured cheat sheet repositories. When I tried to download this one, the operation failed:

$ navi repo browse

Cloning into 'C:\Users\J\AppData\Roaming\navi\cheats\tmp\featured'...
remote: Enumerating objects: 50, done.
remote: Counting objects: 100% (50/50), done.
remote: Compressing objects: 100% (44/44), done.
remote: Total 50 (delta 0), reused 34 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (50/50), 22.83 KiB | 1.34 MiB/s, done.
Cloning https://github.com/infosecstreams/cheat.sheets into C:\Users\J\AppData\Roaming\navi\cheats\tmp...

Cloning into 'C:\Users\J\AppData\Roaming\navi\cheats\tmp'...
remote: Enumerating objects: 10, done.
remote: Counting objects: 100% (10/10), done.
remote: Compressing objects: 100% (10/10), done.
remote: Total 10 (delta 0), reused 2 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (10/10), 9.46 KiB | 4.73 MiB/s, done.
Hey, listen! navi encountered a problem.
Do you think this is a bug? File an issue at https://github.com/denisidoro/navi.

Caused by:
    0: Failed to import cheatsheets from `infosecstreams/cheat.sheets`
    1: Failed to remove directory `C:\Users\J\AppData\Roaming\navi\cheats\tmp`
    2: Operation did not complete successfully because the file contains a virus or potentially unwanted software. (os error 225)

I checked in my Windows Defender history, and it showed that it had blocked the reverse-shells.cheat file, thinking it was a malicious code snippet.

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions