Windows Security detects Trojan:Win32/BatTamper.A in iso

[Ovos-Moles]

Hi,
Just writing to inform that Windows security is detecting the following "Trojan:Win32/BatTamper.A" in the securityonion-2.4.100-20240903.iso.
More details:
containerfile: ...\Downloads\securityonion-2.4.100-20240903.iso
file: ...\Downloads\securityonion-2.4.100-20240903.iso->SecurityOnion\agrules\detect-sigma\rulesets\sigma_all_rules.zip->rules/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml
file: ...\Downloads\securityonion-2.4.100-20240903.iso->SecurityOnion\agrules\detect-sigma\rulesets\sigma_core++.zip->rules/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml

Regards,

OM

[defensivedepth]

Hello there!

From our docs: https://docs.securityonion.net/en/2.4/download.html#download

If you download our ISO image and then scan it with antivirus software, it is possible that one or more of the files included in the ISO image may generate false positives. If you look at the antivirus scan details, it will most likely tell you that it alerted on a file in SecurityOnion\agrules\.

[Ovos-Moles]

Thanks for the reply.
I understood that the referenced yml files were probably false positives but thought I'd alert the devs as windows security proceeded to lock down the iso.
Forgot to say, I did not scan the iso. This came up in a routine scheduled scan.
Thanks.
OM