Kali Linux Now in Windows Store, but Defender Flags Its Packages as Threats!

[LASER_oneXM]

The penetration testing and security auditing platform called Kali Linux is now available in the Windows 10 Store as a Linux environment that can be used with the Windows Subsystem for Linux (WSL). The problem is someone forgot one little thing. Some of Kali's more popular packages are detected as hacktools and exploits by Windows Defender.

For those not familiar with Kali Linux, it is a Linux distribution geared towards penetration testing, forensics, reversing, and security auditing. Using Kali you can download a variety of security related programs such as Metasploit, Armitage, Burp, and more and use them to test your network for security holes.

In order to use Kali, you will first need to install the Windows Subsystem for Linux from the Windows Features control panel. Once installed, you can go to the Windows Store, search for Kali Linux, and install it for free.

Once you get Kali running and start installing tools, though, you run into a problem. Kali will appear to hang and ultimately error out, while Windows Defender begins to display virus alerts.

It appears that the developers in Microsoft's WSL team forgot to tell the Windows Defender team about Kali Linux's availability. This is because some of Kali's packages will be detected as hacktools, viruses, and exploits when you try to install them!

Windows Defender Quarantined These Kali Packages
If you take a look at one of the detected threats details, you can clearly see that some of the Metasploit components are being detected by Windows Defender when we try to install it in Kali.

 

[Azure]

HA hence my question. like WTF.

Why Kali why not get something easy like UBUNTU.

You can.

 

[Deleted member 65228]

The detection's aren't false positive because the detection's really are picking up harmful content. However, obviously a researcher needing to use them for experimental purposes can white-list and ignore the detection's.

Anyone who is downloading those packages is going to understand what they are for so they will know to white-list and ignore the detection... Only requires a few clicks to do, big deal. Lmao

 

[Azure]

Really?! Cool! So does it run in a VM like enviroment inside windows? So is there any benefit of running it that way vs dual boot?

I wouldnt know since I dont bother with Linux. I simple search for Ubuntu on the Microsoft Store gives you a quick result.

 

[Deleted member 65228]

Really?! Cool! So does it run in a VM like enviroment inside windows? So is there any benefit of running it that way vs dual boot?

Use it on a research/testing environment not your home user environment. It will potentially leave the system more vulnerable in the case of compromise by an attacker easing work if the attack is e.g. a backdoor.

Don't add what you don't truly need on your main home system, less is more.