False positive: Microsoft Defender flags fen.exe as Trojan:Win32/Bearfoos.B!ml

[maksburg]

Microsoft Defender flags fen.exe as Trojan:Win32/Bearfoos.B!ml and places it in quarantine.
Defender lists the following under Affected items:
file: C:\Program Files\fen\fen.exe
This indicates that fen.exe itself is the detection object, not that it has executed trojan behavior or impacted other system components.

Timeline / context

• fen was successfully installed and used normally for a period of time prior to detection
• At 2026-01-19 04:20, Microsoft Defender detected Trojan:Win32/Bearfoos.B!ml and quarantined fen.exe.
• Detection occurred without any recent update or configuration change to fen.

Investigation summary

A full investigation was performed, including:

• Windows Security Event Logs (Security, Application, System)
• Process creation auditing (no Event ID 4688 for fen.exe)
• OpenSSH logs (no SSH activity)
• Network inspection (netstat)
• Firewall configuration review

Findings

• No execution of fen.exe
• No child processes (cmd, PowerShell, etc.)
• No persistence (services, scheduled tasks, registry)
• No inbound or outbound network activity
• No additional affected files or processes

---

Important clarification: firewall configuration

fen.exe is explicitly blocked from outbound network access via Windows Firewall using a program-specific rule:

• Direction: Outbound
• Action: Block
• Scope: All profiles

This rule is applied prior to execution, meaning fen.exe is network-isolated and cannot establish any outbound connections.

The detection therefore appears to be purely static / ML-based, independent of runtime behavior or network access.

---

Likely cause

This appears to be a false positive triggered by a combination of:

• Go static binary (no observed code signing, low reputation)
• Use of os/exec (command execution capability)
• Embedded Lua runtime / script evaluation
• Behavioral patterns matching Go-based control tooling

This aligns with Defender’s !ml (machine learning) classification and the Bearfoos family, which is commonly applied to Go-based RAT-like patterns.

---

Environment

• OS: Windows 10 / Windows 11
• Antivirus: Microsoft Defender (default configuration)
• fen binary: Installed under C:\Program Files\fen\fen.exe
• Firewall: Outbound traffic for fen.exe explicitly blocked

---

Impact

• fen was successfully installed and used normally for a period of time prior to detection
• Defender wording may lead users to believe active trojan behavior occurred
• Affects usability and user trust on Windows platforms

---

Notes / suggestions

• This may benefit from a Microsoft Defender false-positive submission by the maintainers
• Code-signing of release binaries could significantly reduce ML-based detections
• Explicit documentation stating that fen does not accept remote commands or listen on the network may help reduce confusion for users

I’m happy to provide logs or additional technical details if useful.

/m4k5