Hi,
me an my colleagues use OpenVPN-client in combination with some "up"-scripts to automatically execute "ncat". The OVPN-tunnel are created manually using its default GUI and once in a while Windows Defender rates "ncat" as a threat and puts it into quarantine. One needs to get things back from there, create an exception for that Exe and things work for some weeks, until Windows Defender decided the same Exe to be a threat again. That is really annoying and I didn't find why one needs to repeat the exception-process once in a while. The Exe it self definitely did not change.
Treating "netcat" that way is even documented:
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/Ne...
That article is from 2007, so why need to be these Exes still treated as threat? I'm a developer, Microsoft even developed Windows Subsystem for Linux these days and though basic tools like that are threats? Even if indirectly started using some GUI?
That doesn't make much sense to me and I would like to suggest reconsidering that decision. AV-scanners are a constant source of annoyance anyway already: They slowdown your system, annoy you with false-positives like this, contain bugs regularly making your system less secure etc. And this is "ncat", it has very limited file handling and whatever might threaten you at all:
http://man7.org/linux/man-pages/man1/ncat.1.html
Set them free! :) Thanks!
