Windows Defender flags a file from the official Rust download as Trojan:Win32/Suschil!rfn

[Thorgt]

Hi everyone,

While installing Rust on Windows using the official installer from https://rustup.rs/, Microsoft Defender detected and quarantined a file as Trojan:Win32/Suschil!rfn.

Details

OS: Windows 11.
Download source: https://rustup.rs/ (official site)
Installer used: rustup-init.exe
Defender action: [Quarantined / Removed]
Detection time: 26/10/2026

What happened
After the detection, the installation failed with:

error: component download failed for rustfmt-x86_64-pc-windows-msvc:
could not read downloaded file: 'C:\Users[user].rustup\downloads[hash]'

I’m not sure whether the detection caused this error or whether it is a coincidence.

What I’m trying to find out

Is this a known false positive? The !rfn suffix suggests a generic/heuristic detection, and I’ve seen similar reports with other legitimate installers.
Can someone verify the SHA-256 hash of the file from the official source so I can compare it with mine?
Has anyone else seen this detection with the same file or version?

What I’ve done so far

I did not restore the file from quarantine.

I’m not claiming the official Rust distribution is malicious. I’m posting this so others can confirm whether it’s a false positive and so the maintainers are aware. Any help is appreciated.

Thanks!
Thorgt

[arminazimi]

This looks like a Defender false positive, and it also explains the second error. !rfn detections are Microsoft's cloud reputation heuristics, which tend to flag freshly downloaded, low-prevalence binaries. If Defender quarantined a file while rustup was still extracting it, the later could not read downloaded file error is what you would expect.

What I would do:

1. Verify the download. Compare the SHA-256 of rustup-init.exe with the one Rust publishes next to it:

   Get-FileHash .\rustup-init.exe -Algorithm SHA256

   The expected value is at https://static.rust-lang.org/rustup/dist/x86_64-pc-windows-msvc/rustup-init.exe.sha256. If they match, the file is the genuine one.
2. Restore and retry. Open Windows Security > Virus & threat protection > Protection history, restore the quarantined item, then delete %USERPROFILE%\.rustup\downloads and run the installer again.
3. Report it. Submit the file as a false positive at the Microsoft Security Intelligence submission page (choose "Microsoft Defender Antivirus", "I believe it should not be detected"). Detections like this are usually cleared in a day or two.
4. If it keeps happening, temporarily add an exclusion for %USERPROFILE%\.rustup and %USERPROFILE%\.cargo while installing, then remove it. Installing through winget install Rustlang.Rustup is another route that avoids the browser download.

I am assuming the file you verified in step 1 is the one Defender flagged. If the hash does not match, do not install it and download again from rustup.rs.