W10UI triggers defender behavior detection

[habzg]

While running W10UI to integrate updates into a mounted image, this detection appears twice:

Threat blocked
2026. 06. 13.
Severe

Detected: Trojan:Win32/Commando.A!ml
Status: Removed
A threat or app was removed from this device.

Date: 2026. 06. 13.
Details:
This program is dangerous and executes commands from an attacker.

Affected items:
CmdLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $r='D:\W10UItemp_27723\W10UIreg.txt'; $f=[IO.File]::ReadAllText('D:\Files\W10UI.cmd') -split ':cbsreg\:.*';iex ($f[1])

The script seems to fail after this.

[habzg]

Additional detection after definition update:

Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Commandrob.A!ml&threatid=2147849223&enterprise=0
 	Name: Trojan:Win32/Commandrob.A!ml
 	ID: 2147849223
 	Severity: Severe
 	Category: Trojan
 	Path: CmdLine:_C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $f0=[io.file]::ReadAllText('D:\Files\W10UI.cmd');$0=($f0-split'\$:DIR2ISO:.*')[1];$1=$env:1-replace'([`@$])','`$1';iex("$0 `r`n :DIR2ISO $1"
 	Detection Origin: Unknown
 	Detection Type: FastPath
 	Detection Source: System
 	User: NT AUTHORITY\SYSTEM
 	Process Name: Unknown
 	Security intelligence Version: AV: 1.453.82.0, AS: 1.453.82.0, NIS: 1.453.82.0
 	Engine Version: AM: 1.1.26050.11, NIS: 1.1.26050.11

[abbodi1406]

This is expected unfortunately with the AI era
there is no way to convince ms or other AVs that this is safe measure

as long as you acquire the script from the trsuted source, then it's false-positive