netbird_installer_0.51.2_windows_amd64.exe triggers Windows Defender ASR rule

[robertgro]

The latest release

https://github.com/netbirdio/netbird/releases/tag/v0.51.2

and especially the

netbird_installer_0.51.2_windows_amd64.exe

is unable to trigger the uninstall of the previous version due to when executing the binary, it triggers the Windows Defender ASR rule

https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#attack-surface-reduction-rules-by-type

namely

"Block executable files from running unless they meet a prevalence, age, or trusted list criterion"

I hope there will be a quick fix soon!

[robertgro]

@nazarewk

Well, I don't know why Microsoft seems to infiltrate systems with their security proposals. Makes me think about switching to another AV solution on all of my clients. In addition, finding working helpful information regarding this 'security critical' matter results in many misleading google search results. I don't have the time to dig that deep into the dependency I rely upon that has been introduced into Windows systems quietly and secretly. Big sigh

For additional background info: Windows Defender was about to block nearly every .exe file interaction, which led in me not being eligible (contact your administrator) to even uninstall netbird on my system. As if you were locked out of your own system with the recent updates for security reasons... Nevermind.

Nevertheless, the issue has been resolved with this command issued to the terminal:
Set-MpPreference -AttackSurfaceReductionRules_Ids 01443614-CD74-433A-B99E-2ECDC07BFC25 -AttackSurfaceReductionRules_Actions AuditMode

The trick is to figure out which id causes the issue and then run the proper command to configure it.

I really gotta say BIG thank you to @MHaggis for saving me time with this by provding us with the https://github.com/MHaggis/ASRGEN/tree/main and his app on https://asrgen.streamlit.app/ASR_Configurator.

Now my auto update script composition at #1793 (comment) is working again, although it could hopefully soon become obsolete, see this PR #4256