Defender for cloud apps alerts on System.ValueTuple.dll

The Toolkit General Discussion
1

I got PSADT v4 from this website and created few packages and uploaded to teams for archiving, Defender for cloud apps is alerting our security department on System.ValueTuple.dll containing malware, most likely false positive (virustotal does not find any issue) but wanted to check here anyway if there are more alerts on this ?

2

If you got it from Release PSAppDeployToolkit 4.0.6 · PSAppDeployToolkit/PSAppDeployToolkit · GitHub, this is the first time I hear about a false positive for PSADT v4 from a virus checker.

3

This file is also digitally signed by Microsoft, so no idea the go is there…

image
image1150×817 73.7 KB

In saying that, it’s also not the latest version from upstream, but it’s depended on by dependency project we use so we’re limited on how much we can freely update it.

4

I don’t usually like to muck with dependency libraries like this, but I’ve updated Wpf.Ui’s dependent System.ValueTuple dependency from 4.5.0 to 4.6.1, so let’s see if it improves things.

Also reported the issue upstream to the Wpf.Ui team: Update `System.ValueTuple` dependency from `4.5.0` to `4.6.1`. · Issue #1434 · lepoco/wpfui · GitHub

5

I think there could be benefit in updating the DLL dependencies, as it may fix other issues, so may not be a waste of effort, but the problem here is more likely to lie with Microsofts Defender for Cloud… (Without going too off subject)
IMHO the whole Microsoft suite of products quality has dropped off a cliff since Microsoft have chosen to ‘employ’ or use AI to do the work of previously pretty competent real people, who could unit test and cross check their code - Unfortunately the AI that they current use seems incapable of doing this accurately.
We use Windows Defender for Endpoint and I am regularly having to ‘report’ innacurate or clearly very wrong issues with the data served by MDE - (‘report’ is what Microsoft like to call it, I prefer to use the term notify as any report can take months to get them to provide a resolution)
The latest example:

image
image908×592 39.1 KB

FYI: The latest available version of GIMP is 3.0.4 so we will be waiting a VERY long time for v11.3.106.0 :rofl: It’s not certain the SyncBackFree Application is even included in the GIMP product!

The Zero Day Initiative page: https://www.zerodayinitiative.com/advisories/ZDI-25-322/ (which MDE appears to have obtained its data from - albeit inaccurately) does not list an updated GIMP version but the actual SyncBack product version that needs updating :exploding_head: