Windows Defender blocks Connect-SPOService, False positive? Detected: Trojan:Script/Wacatac.H!ml

[nmcgregor23]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

SharePoint REST API

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

Multi-Geo, SharePoint site is in France.

Describe the bug / error

When connecting to the sharepoint admin site using Connect-SPOService, Defender flags it as a Trojan.

Multi-Geo, this site is in France.
$AdminSite = "https://Contosofra-admin.sharepoint.com/"
Connect-SPOService -Url $adminSite

Steps to reproduce

1. Run Connect-SPOService
2. Login with Account
3. Receive this error message

4. Select Yes
5. Defender blocks it as a Trojan

Expected behavior

Successfully log into Sharepoint

[nmcgregor23]

More troubleshooting steps and eventual work around:

1. Removed all SPO modules
2. Reinstalled module
3. Cleared caches (e.g. LOCALAPPDATA, APPDATA, INTERNET)
4. Restart PC
5. pwsh 7.6.1 (-UseWindowsPowerShell) to connect.

Workaround: -UseSystemBrowser parameter allowed me to login successfully

[Ashlesha-MSFT]

Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.

[Ashlesha-MSFT]

@nmcgregor23,
We tested this scenario but were unable to reproduce the Defender alert in a clean environment. This suggests the behavior may be intermittent and dependent on specific Defender signatures or local environment conditions.

Please update your Defender signatures and retry. If the issue persists, you can use the -UseSystemBrowser parameter as a workaround.

If the problem continues after updates and impacts your workflow, please raise a Microsoft support ticket with Defender logs and environment details for further investigation.