Antivirus and EDR alerts

Updated November 11, 2026

Antivirus and endpoint detection and response (EDR) products sometimes flag the NetBird client as malicious, often in the days after a new release. This page explains why, how to check an alert, and how to report a false positive.

Why NetBird gets flagged

A VPN client has to make deep changes to a device. NetBird runs as a privileged service, creates a network interface, changes routes, DNS, and firewall rules, accepts connections from other peers, and can update itself. Security products judge software largely by heuristics and machine learning models, and these behaviors match what their models associate with malware. A new release also starts with little reputation, so the same behavior that was trusted yesterday can be flagged today.

These detections are the security product's assumptions, not findings in NetBird. Signed, unchanged NetBird builds still get flagged, and no change on our side can fully prevent it. We report the false positives we see to the vendors, and they keep confirming them as false positives, but only the vendor can change its detection. Reports from users can help them do that faster.

Check the alert

Do not dismiss an alert without checking it:

1. Signature: the file is intact and comes from NetBird.
   • On Windows, run Get-AuthenticodeSignature "<path>" | Format-List Status, SignerCertificate. Status must be Valid (a modified file shows HashMismatch), and the subject should start with CN=NetBird GmbH. In the file's Properties > Digital Signatures > Details, the same check reads "This digital signature is OK". Two files in the install folder are exceptions: the wintun.dll network driver library is signed by its developer, WireGuard LLC, and netbird_uninstall.exe is not signed.
   • On macOS, run codesign --verify --deep --strict --verbose=2 /Applications/NetBird.app, which should report valid on disk, then codesign -dvv /Applications/NetBird.app, whose output should include Authority=Developer ID Application: NetBird GmbH. For the installer package, run pkgutil --check-signature <installer>.pkg and look for Developer ID Installer: NetBird GmbH.
   • On Linux, if you installed from the NetBird package repository, run dpkg --verify netbird (Debian, Ubuntu) or rpm -V netbird (Fedora, RHEL). No output means the installed files match the package. Add netbird-ui if you use the desktop app.
2. Source: NetBird came from the official installation guides or GitHub releases. On Windows, use the .exe or .msi installer or an archive ending in _signed. The other Windows archives contain unsigned binaries.
3. Timing: the alert lines up with an expected change, such as an update you just rolled out.

If all three hold, the alert is most likely a false positive. Source and timing alone do not prove a file is unchanged, so do not add an exception for a file whose signature or package check you cannot complete. These checks also cannot rule out a compromised release, so if anything looks off, or you are unsure, see If you suspect a genuine threat.

Report a false positive

Report the detection to your vendor, with the NetBird version, the detection name, the file name, and its SHA-256 hash (Get-FileHash <path> on Windows, shasum -a 256 <path> on macOS, sha256sum <path> on Linux).

For other products, search the vendor's documentation for "false positive submission".

Allow NetBird in the meantime

If you need the client running before the vendor responds, add an exception scoped to the NetBird files or install folder, never to broad folders such as C:\Program Files, and never by turning protection off.

• File-hash exceptions break with every release.
• Publisher certificate exceptions, where your product supports them (for example, certificate indicators in Defender for Endpoint), survive updates, but may need updating when NetBird renews its signing certificate. They trust every file signed with that certificate, not only the NetBird install folder, so limit them to the devices that run NetBird and, where your product supports it, set an expiry. They do not cover wintun.dll or the unsigned uninstaller.

An exception does not always silence alerts or incidents that are already raised. Check your vendor's documentation for what it covers.

If you suspect a genuine threat

Quarantine the file and report it to security@netbird.io or through GitHub private vulnerability reporting. Include the alert details, your security product and version, the NetBird version and download source, the file path and SHA-256 hash, and any recent upgrades or configuration changes.