What is Defender marking it as? I also wonder if they are just special casing this program and it would work again if the code was shuffled a bit or if it used the AMSI sig [0] instead of EICAR or if they actually fixed the problem.

[0] https://github.com/Roadmvn/C-Full-Offensive-Course/blob/main...