I had a Powershell script embedded in an executable I wrote in C. It launched Powershell as a sub-process and piped the script into standard input. Windows Defe

I had a Powershell script embedded in an executable I wrote in C. It launched Powershell as a sub-process and piped the script into standard input. Windows Defender thought my executable was some trojan (something like trojan:Win32/Wacatac.B!ml). So I gzipped the script as part of the build process, embedded the gzipped script instead, along with a single file decompression library, and decompressed it at runtime - now Windows Defender is okay with my program. Gosh, if I can do that, some malware author can too. If these “heuristic” detections are so easy to bypass, what’s the point?