Windows Defender blocks GitButler 0.22.1 as Trojan:Win32/Wacatac.B!ml

[bagleytravis68]

Version

0.22.1

Operating System

Windows

Distribution Method

msi (Windows)

Describe the issue

GitButler 0.22.1 installs successfully, but Microsoft Defender blocks the desktop GUI executable and removes the application shortcuts.

Note this seems similar to #14906

How to reproduce (Optional)

1. Install GitButler 0.22.1 using the official Windows MSI.
2. Launch GitButler from the Start Menu or directly from: C:\Program Files\GitButler\gitbutler-tauri.exe

Expected behavior (Optional)

GitButler launches normally.

Relevant log output (Optional)

Windows Defender reports:

Trojan:Win32/Wacatac.B!ml
Path: C:\Program Files\GitButler\gitbutler-tauri.exe
Severity: Severe
Category: Trojan




Launching the executable fails with:


The file contains a virus or potentially unwanted software.



Defender also removes or blocks the Start Menu and taskbar shortcuts.

[krlvi]

The root cause is the upstream framework that we use tauri-apps/tauri#2486
Sadly there is very little we can do. We have ran into this in the past as well (one recent example #14906 )

After a couple of days Microsoft stops flagging it. And we do report it as false positive.